Hackers used ASOS’s own app to announce its data breach. Here is what the attack, and the retailer’s response, teach GRC teams about third-party risk and incident response.
Key takeaways from the ASOS data breach incident
- On 6 October 2026, attackers pushed an unauthorized “ASOS HACKED” alert to customers through the retailer’s own app, before ASOS had said anything publicly.
- The route in was social engineering: an employee’s credentials, obtained by impersonating a trusted contact, opened third-party platforms ASOS uses to message customers.
- ASOS issued a market statement 5 hours after the alert, but fuller details of the stolen data emerged only after media reporting.
- Third parties are now involved in 48% of breaches, yet only 15% of UK businesses review risks from their immediate suppliers.
- GRC teams should bring customer-facing SaaS tools into their third-party risk management lifecycle and rehearse an “attacker speaks first” scenario.
Introduction: the risk consequences when the breach notice comes from the attacker
At around 10am on Tuesday 6 October, millions of phones buzzed with what looked like a routine shopping notification. But the message, headed “ASOS HACKED,” was addressed to the online fashion retailer’s data protection officer and IT department, and it threatened to leak customer data unless the company made contact.
Most breach notifications reach customers after a company has investigated, consulted its lawyers and drafted its words. This one reached them first, through the company’s own channel, written by the people who had broken in.
That is what makes the ASOS incident worth studying closely. It exposes 2 gaps that exist in many organizations, in e-commerce and well beyond: the business-owned software platforms that never pass through third-party due diligence, and incident response plans that assume the company will always get to speak first.
What happened at ASOS, and why it matters for risk and compliance teams
Within hours of the alert, ASOS told the London Stock Exchange it was investigating “unauthorized activity involving third-party platforms” used to communicate with customers, had restricted access to them, and believed names and contact details “may have been accessed.”
On 8 October it confirmed how. “We discovered that an unauthorized party gained access to an ASOS employee account by impersonating a trusted contact,” the company said. “Those credentials were then used to access information on certain third-party platforms used by ASOS.” Names, addresses, phone numbers and recent search histories were taken. Payment card details and passwords were not.
ASOS’s shares fell as much as 15% on the first day, then recovered part of the loss. The UK’s National Cyber Security Centre (NCSC) advised all ASOS customers to “assume you are affected by this incident, even if you did not receive the unauthorized notification.”
No core system failed. That wasn’t necessary. A single employee login and the platforms it reached were enough.
The third-party risk gap: the SaaS platforms nobody owns
Customer messaging, push notification and marketing platforms are usually bought by marketing, e-commerce or customer service teams, not IT. They hold contact data for millions of people, and they can talk to all of them at once. Yet in many organizations they are treated as low-risk software subscriptions rather than critical third parties.
The data suggests that blind spot is common, and costly. Verizon’s 2026 Data Breach Investigations Report found (PDF):
- 60% year-on-year increase in breaches involving third-parties
- 48% of all breaches have third-party involvement
- 62% of breaches involve a human element (social engineering)
In the UK, the government’s Cyber Security Breaches Survey 2025/26 found that:
- only 15% of businesses review the cyber risks posed by their immediate suppliers, and
- just 6% look at their wider supply chain.
The ASOS hackers claimed to have gained access through the company’s use of Snowflake. In the US, a 2024 campaign against Snowflake customers reached around 165 organizations, and Mandiant found that:
“every incident Mandiant responded to associated with this campaign was traced back to compromised customer credentials,” on accounts without multi-factor authentication.
“UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion”, Google Cloud
The lesson from that campaign applies here too: a platform can be secure while access to it is not.
In a similar case, Marks & Spencer’s chairman Archie Norman told MPs that the 2025 attack on the retailer began with “sophisticated impersonation,” and that “part of the point of entry in our case also involved a third party.”
Impersonation works because a questionnaire completed at onboarding says nothing about who can log in to a vendor’s platform 18 months later, or how easily those credentials can be talked out of someone.
The reputational risk when the attacker speaks first
The ASOS incident also shows how hard it is to recover once an organization has lost the first word.
Its first statement came the same day, about 5 hours after the rogue alert, and an apology email reached customers that evening. Both made clear that payment card details and passwords were not believed to be affected. “Customer trust is incredibly important to us, and if the situation changes an update will be provided as appropriate,” it said. Within 48 hours it published the root cause and gave customers practical guidance: “We will never ask you to share passwords, security codes or payment details through an unsolicited message or call.” It worked with the NCSC and law enforcement, and notified the Information Commissioner’s Office.
But its first statement described only “basic personal information including name and contact details.” ASOS’s fuller account, which added recent search histories, came after the attackers sent samples of the stolen data to BBC News. As PR consultant Hayley Goff put it, “there is a risk customers feel the company is responding to scrutiny rather than keeping them informed.”
That sequence matters because regulators set the clock regardless of who spoke first. Under UK and EU GDPR, a reportable personal data breach must be notified to the regulator within 72 hours of the organization becoming aware of it.
US-listed companies face their own deadline: a Form 8-K disclosure within 4 business days of deciding an incident is material.
Many organizations would struggle to respond even this quickly:
- Only 25% of UK businesses have a formal incident response plan, rising to…
- 57% of medium-sized businesses, and
- 76% of large businesses. (Department for Science, Innovation and Technology).
As Steve Biggs, Head of Infrastructure and Security at CoreStream GRC, wrote after the Novo Nordisk breach earlier this year:
“Cyber extortion is becoming a governance problem as much as a security problem.”
Steve Biggs, Head of Infrastructure and Security, CoreStream GRC
ASOS shows why. Once an attacker has started telling the story, a company can only take it back with an account that is complete, consistent and kept up to date as the facts change.
What risk and compliance teams should do now to mitigate this enterprise risk
Bring customer-facing SaaS into your third party risk management lifecycle
Start with an inventory of every platform that holds customer data or can message customers directly, whoever bought it. Tier each one by the data it holds and the reach it has, not by contract value. A push notification tool that can reach every customer deserves the same scrutiny as a payment provider.
Treat platform credentials and API keys as privileged access
Admin accounts on marketing and messaging platforms should meet the same standard as core systems: phishing-resistant multi-factor authentication, named owners, regular access reviews and prompt removal when people leave. Ask vendors how they log and alert on unusual administrative activity, and build those questions into due diligence and renewal.
Monitor continuously, not once at onboarding
A one-off questionnaire cannot tell you that a vendor’s risk profile has changed. Third-party risk management tools that track security posture and access changes over time turn third-party risk assessment from an annual event into an ongoing control.
Rehearse the scenario where the attacker speaks first
Add a hijacked-channel scenario to your incident response exercises. Who can disable customer messaging in minutes? Who approves a holding statement? How will you reach customers if your own channel is compromised? Agree the answers, and your regulatory notification steps, before you need them.
“When the first word about a breach comes from the attacker, the instinct is to play it down. That creates a second reputational risk on top of the first. If the picture later turns out to be bigger than your first statement suggested, customers stop trusting anything else you tell them. Say what you know, be clear about what you don’t, and plan how you will update people as the facts change.”
Paul Cadwallader, GRC Strategy Director, CoreStream GRC
These steps are easier to sustain when vendor inventories, access reviews and incident playbooks sit in one place rather than across spreadsheets and inboxes. CoreStream GRC’s configurable Third Party Risk Management solution connects them in a single, integrated risk management view.
Conclusion: what risk and compliance professionals can learn from the ASOS data breach incident
ASOS didn’t choose the moment its customers learned of the breach. But, it did choose what happened next, and its response combined prompt, practical steps with a first account that proved too narrow. That second part is the one most worth learning from.
For every other organization, the lesson is to get both halves right before an incident, not during it. Know which third parties can speak to your customers, govern who can log in to them, and rehearse what you will say if someone else gets there first.
To test how well your third-party risk program would stand up to an incident like this, book a workshop with CoreStream GRC’s strategy team.
Frequently asked questions about the ASOS breach
On 6 October 2026, an attacker sent an unauthorized “ASOS HACKED” push notification to customers. ASOS later confirmed that the attacker had impersonated a trusted contact to obtain an employee’s credentials, then used them to access third-party platforms it uses to message customers. Names, contact details and search histories were taken, but not payment data or passwords.
They hold large volumes of personal data and can contact every customer at once. Because marketing or customer teams often buy them outside IT procurement, they can bypass third-party risk assessment and the access controls applied to core systems. If an attacker gains access, they can steal data and speak to customers in the company’s name.
In the UK and EU, a reportable personal data breach must be notified to the data protection regulator within 72 hours of the organization becoming aware of it. In the US, listed companies must file a Form 8-K within 4 business days of deciding a cyber incident is material.
It should cover a full inventory of SaaS platforms holding sensitive data, risk tiering based on data and reach, minimum access controls such as phishing-resistant multi-factor authentication, continuous monitoring rather than one-off questionnaires, and incident response steps that assume a vendor-hosted channel could be compromised. Contracts should also set out how quickly the vendor must tell you about a security incident.
The UK’s National Cyber Security Centre (NCSC) advises all ASOS customers to assume they are affected, even if they did not receive the rogue notification. ASOS says payment details and passwords were not accessed, so no action is needed on your account. The bigger risk is convincing scam messages that use your name, address or shopping history, and these may arrive weeks later. Don’t click links in unexpected messages, emails or calls claiming to be from ASOS. The company says it will “never ask you to share passwords, security codes or payment details through an unsolicited message or call.” If you use your ASOS password on other sites, change it there. In the UK, forward suspicious emails to report@phishing.gov.uk and scam texts to 7726.
