LONDON, United Kingdom — British online fashion retailer ASOS has disclosed a cybersecurity breach in which an unauthorised party accessed some customer information after impersonating a trusted contact to obtain an employee’s login credentials. The incident highlights how attackers can exploit human trust and employee access to reach information stored across third party business platforms.
The company disclosed the incident on October 8, 2026, saying its initial investigation found that customer personal information had been accessed. ASOS said payment card details and account passwords were not exposed in the incident.
Employee Credentials Were the Entry Point
According to the company’s initial account, the attacker impersonated a trusted contact to obtain the credentials of an ASOS employee. Those credentials were then used to access information held on certain third party platforms used by the retailer.
The incident illustrates a common social engineering technique: rather than relying exclusively on software vulnerabilities, attackers manipulate employees into revealing information or granting access. Messages that appear to come from colleagues, business partners or service providers can create a false sense of urgency or legitimacy.
Once valid credentials are obtained, an attacker may be able to operate within existing access permissions, making suspicious activity more difficult to distinguish from normal business operations.
Third Party Platforms Add Another Layer of Risk
Modern retailers rely on external platforms for a wide range of activities, including customer engagement, marketing, analytics and business operations. These integrations can improve efficiency, but they also introduce additional points that security teams must protect.
ASOS said it immediately locked down the affected platforms to prevent further access. The company also stated that its website and mobile application remained safe to use.
The incident underscores why organisations need to review not only their core networks but also the applications connected to employee accounts. Security controls should ensure that third party access is limited to necessary information and can be revoked quickly when suspicious behaviour is detected.
How Organisations Can Reduce Social Engineering Risks
Multi-factor authentication can make stolen passwords less useful to attackers, although some forms of authentication can still be targeted through phishing or session theft. Organisations should combine it with phishing-resistant authentication where practical, identity monitoring and restrictions on access to sensitive systems.
Employees should also be trained to verify unexpected requests for credentials through a separate, trusted communication channel. Security teams can strengthen protection by monitoring unusual sign-ins, reviewing access permissions and investigating unexpected activity involving external platforms.
Incident response plans should include procedures for disabling compromised accounts, revoking active sessions, securing integrations and assessing which information may have been accessed.
Customer Vigilance Remains Important
ASOS customers should be cautious of unexpected messages claiming to offer refunds, resolve account issues or verify personal information. They should avoid sharing passwords or payment details through unsolicited links and should access their accounts through the company’s official website or application.
The company said it was cooperating with law enforcement and relevant regulatory authorities. The full scope of the incident was not established in the initial disclosure.
The breach serves as a reminder that cybersecurity depends on more than strong technical infrastructure. Protecting customer information also requires secure identity management, employee awareness and continuous oversight of the external services connected to a business.
This website uses cookies.