Asos was breached by someone pretending to be a trusted contact.
No clever malware. Just a convincing message and one employee's login. It's the most common way into a business of any size, and the defences are cheap.
What happened
Last week Asos customers received an unexpected message in the shopping app. It claimed hackers had stolen the company's data and linked to a Telegram channel. Asos then confirmed a breach.
According to Asos, someone impersonated a trusted contact to get an employee's work login. With that login they reached some of the online services Asos uses, sent the app notification, and accessed customer information including names and contact details. Asos says payment card details and passwords were not affected. Later reporting suggests more was taken, such as shopping searches, and the ICO is assessing the incident.
The part that matters for you
Take away the big brand and this is an ordinary attack. Nobody broke in. Someone was let in.
The trick works because most of us are helpful. A message that seems to come from a colleague, a supplier, or the IT company, asking you to sign in, approve a prompt or read out a code, doesn't feel like an attack. And one login often opens far more than email: the accounting system, the file share, the CRM, the online services nobody remembers signing up for.
Businesses get exactly this, every week. It's usually how email accounts get taken over, and how invoice fraud starts.
Five things to put in place this week
- Agree a "call back" rule. Any request to share a login, approve a sign-in, reset a password or change bank details gets checked by calling the person on a number you already have. Not the number in the message.
- Use multi-factor authentication everywhere, and make it hard to give away. Number matching in the Microsoft Authenticator app, or passkeys and security keys, stop most "just read me the code" tricks.
- Tell your team the IT company will never ask for their password. Then make sure that's true. Whoever looks after your IT should have their own admin accounts.
- List the online services you use, and who can get in. Remove leavers, remove old accounts, and turn on MFA for each one. The forgotten system is the one that gets used.
- Check your own customers can tell a real message from a fake. Set up SPF, DKIM and DMARC so nobody can send email as you. The free email security checker tells you where you stand in a few seconds.
Most of this is part of Cyber Essentials, the government-backed scheme built around controlling who has access and how they sign in.
If you shop with Asos
Expect scam emails, texts and calls that use your name and shopping details to look real. Asos says it will never ask for passwords, security codes or payment details through a message or call you weren't expecting. Neither will any other genuine company.
If it's already happened to you
If someone has used a login they shouldn't have, change the password, sign them out of every session, and check what they could see. If personal data was involved, my guide to reporting a breach to the ICO explains whether the 72-hour clock applies. And if you'd rather not do it alone, my cyber incident response can take it from there.
Sources
Want a second pair of eyes on this?
I'll tell you honestly where a fake contact could get into your business.