What: Asos confirmed that a hacker who impersonated a trusted contact to obtain an employee's login credentials accessed customers' names and contact details on third-party platforms, with no payment card data or passwords exposed.

Why it is important: A single employee fooled by an impersonator was enough to open a path into customer data held on third-party platforms. The same pattern has already appeared at De Bijenkorf through a logistics partner.

British online fashion retailer Asos said on Thursday that a cybersecurity breach earlier this week had exposed some customers' personal information, including names and contact details, according to its initial investigation. In an email to customers, the company said the hacker also had access to some non-personal account information, but not payment card information or account passwords.

An unauthorised party gained access to an employee account by impersonating a trusted contact to obtain login credentials. Those credentials were then used to access information on certain third-party platforms used by the company. The affected platforms were immediately locked down, ensuring no further information could be accessed. Asos said its website and app were safe to use throughout and remain so, and it is working with the relevant law enforcement and regulatory authorities.

Shares in Asos rose 3%, paring the week's loss to 8%. Social engineering operations, where hackers impersonate workers to gain access to company networks, are prevalent. British companies and institutions have faced increasingly aggressive cyber and ransomware attacks in recent years, with the British Library, the London Underground, Marks & Spencer, the Co-op and Jaguar Land Rover among those that suffered months of disruption.

IADS Notes: Asos's confirmation that an employee account was compromised through impersonation follows the unverified claims of earlier in the week, when customers received app notifications alleging a hack and the share price fell more than 10% (Financial Times, October 2026). The third-party route recurs across recent coverage. A cyberattack on logistics partner CEVA exposed De Bijenkorf customers' names, addresses and contact details, and the store warned shoppers of heightened phishing risk (nu.nl, September 2026). Analysis of why retail is so exposed points to attackers using weaker third-party providers to reach wider networks (Retail Insight Network, July 2026). Social engineering and impersonation also remain central threats, with members reporting more than 106,000 domains in the second quarter of 2026, largely linked to impersonation (RH-ISAC, July 2026). The leadership cost of such incidents is visible at Co-op, whose chief executive is stepping down as the costs of its cyber attack mount (Financial Times, March 2026).

Asos says cyber hack accessed customers' personal data