What the ASOS Cyber Incident Teaches Businesses About Account Security

A compromised employee account can create risks far beyond the individual user. This article looks at what businesses can learn from the recent ASOS cyber incident, including the importance of access controls, authentication, third-party oversight and incident response.

A convincing message from a familiar contact can be enough to put sensitive business information at risk. The recent cyber incident involving ASOS highlights why organisations need to consider both how they protect employee accounts and what those accounts can access.

This Cyber Security Awareness Month, it offers a useful question for every business: if one employee’s account was compromised, how far could the consequences reach?

What Happened at ASOS?

On 6 October, some ASOS customers received an unauthorised push notification. In its subsequent update, ASOS said an attacker had impersonated a trusted contact to obtain an employee’s login credentials. Those credentials were then used to access information on certain third-party platforms.

ASOS reported that names, contact details and some account-related information were accessible. It said its investigation had found no access to payment card information or account passwords, and that its website and app remained safe to use. The affected platforms were locked down and an investigation was launched.

These public statements do not establish exactly which security controls were in place or how they were overcome. However, the incident provides a valuable opportunity for other organisations to review their own exposure.

Customer Trust Is Part of Business Resilience

A cyber incident does not need to shut down a business to cause harm. Customers may still face uncertainty about their information, while employees must investigate what happened and respond to concerns.

Names and contact details also have value to criminals. They can help make follow-up scams appear more convincing. In its advice to ASOS customers, the National Cyber Security Centre (NCSC) warned that suspicious messages can arrive some time after a breach.

For businesses, protecting customer communications deserves attention alongside protecting customer records. An account that can send messages under your organisation’s name carries significant responsibility.

Turn Awareness Into Practical Protection

Staff should feel confident questioning unexpected requests, including those apparently coming from colleagues or trusted suppliers. Encourage employees to verify unusual requests through a separate, known contact method and make reporting concerns straightforward.

Training should be supported by strong technical controls. Multi-factor authentication adds protection beyond a password, but different methods offer different levels of security. The NCSC recommends using the strongest practical options, including phishing-resistant methods where available.

A useful review should also ask whether employees have more access than their role requires. The principle of least privilege means limiting permissions to what someone needs to do their job, reducing the access available to an attacker if that account is compromised.

For example, consider whether someone who prepares customer communications also needs permission to export an entire customer database. Where platforms allow it, separate sensitive activities and introduce additional approval for actions with a substantial business impact.

Include Third-Party Services in Your Planning

Make an inventory of the external platforms your business uses, the information they hold and the employees who can access them. Include marketing tools, customer databases and file-sharing services.

For each important platform, establish who owns the relationship, who can suspend access and how to reach the provider during an incident. These are practical questions to resolve before an urgent situation arises.

Rehearse the Response

A response plan becomes more useful when people have practised using it. The NCSC recommends exercising incident response and communicating clearly with stakeholders during an incident.

Try a simple scenario: an employee account has been compromised and customers have received an unauthorised message. Who investigates? Who contacts the provider? Who approves the customer update?

Use the discussion to identify gaps, assign responsibilities and agree improvements.

Make This Month a Starting Point

Cyber Security Awareness Month is an opportunity to turn awareness into action. Reviewing access permissions, strengthening authentication and rehearsing incident response are practical steps towards better protection.

At AJC, we help organisations strengthen their approach to cyber security through services including Cyber Essentials, Cyber Essentials Plus and ISO 27001 support.

Contact AJC on 020 7101 4861 or email info@ajollyconsulting.co.uk to discuss your organisation’s cyber security priorities and the next steps for your business. 

Sources:

Original Enterprise Risk article
ASOS customer update
NCSC customer advice.

Image accreditation: Ron Lach (August 2021) from Pexels.com. Last accessed on 19th October 2026. Available at: https://www.pexels.com/photo/portrait-of-woman-in-green-jacket-and-skirt-9769860/