When you picture a cyber-attack, it’s easy to imagine something highly technical happening behind the scenes. A vulnerability being exploited, malware finding its way into a network, or someone furiously typing away at a keyboard.
But the recent ASOS incident started somewhere much more familiar: with trust.
In October 2026, ASOS confirmed that an unauthorised party had impersonated a trusted contact to obtain an employee’s login credentials. Those credentials were then used to access information held on certain third-party platforms.
And that’s what makes this incident worth looking at. The attacker didn’t just target technology. They targeted trust.
It Started With Trust
ASOS says the attacker gained access to an employee account by impersonating a trusted contact and obtaining login credentials. The affected third-party platforms were subsequently locked down while ASOS investigated the incident with internal and external cyber specialists.
It’s a useful example of why the phrase “people are the weakest link” has never sat particularly well with us. People can be targeted, but that doesn’t mean they have to be the weakness.
And the wider research backs up just how important the human side of security remains. Analysis of Verizon’s 2026 Data Breach Investigations Report found that the human element was involved in 62% of confirmed breaches, while social engineering accounted for 16% of breach patterns. (Ninjio, 2026)
The answer isn’t to make employees suspicious of everything. It’s to give them the confidence to recognise an unusual request, question it, and verify who they’re actually dealing with.
But They Didn’t Get Payment Details…
There was some reassuring news. ASOS confirmed that payment card information and account passwords were not accessed. However, the unauthorised party did have access to personal information including names and contact details, as well as certain non-personal account-related information. (Asos,2026)
It’s tempting to hear “no payment details” and assume the danger has passed. But customer information doesn’t have to include card numbers or passwords to matter.
Following the incident, the National Cyber Security Centre warned ASOS customers to watch for suspicious messages, noting that these can arrive sometime after a data breach. The NCSC also recommended passkeys, or strong separate passwords combined with two-step verification. (NCSC,2026)
For businesses, the lesson is straightforward: know what information you hold, where it lives and who can access it.
Protecting data shouldn’t begin and end with the information that looks obviously sensitive.
Your Security Perimeter Isn’t Just Your Network
There’s another important part of the ASOS story. Once the employee credentials had been obtained, they were used to access information held on certain third-party platforms used by ASOS. (Asos,2026)
Modern businesses rely on cloud platforms, suppliers and connected services every day. So the security conversation can’t stop at “Is our network protected?”
Businesses also need to understand who can access their information, which accounts can reach it and what happens if those credentials are compromised.
This is where identity, access and third-party risk meet. Your organisation might own the data, but that doesn’t necessarily mean it only exists within systems you own.
Stop. Check. Verify.
If there’s one practical habit worth taking from this incident, it’s simple:
Stop. Check. Verify.
Stop. Does this request make sense?
Check. Is this something that person would normally ask you to do?
Verify. If you’re unsure, contact them through another trusted route before sharing credentials or sensitive information.
Technical controls still matter. The NCSC recommends measures including passkeys, or strong separate passwords alongside two-step verification. [ncsc.gov.uk]
But technology works best alongside people who feel comfortable stopping and questioning something that doesn’t look right.
The goal isn’t to remove trust from the workplace. It’s to make trust harder to exploit.
Trust Is Part of Your Security Perimeter
Modern businesses run on trust. We trust colleagues, suppliers, the platforms holding our information and the familiar notifications appearing on our phones.
The ASOS incident is a reminder that all of those relationships form part of the modern security picture. In fact, some customers received an unauthorised push notification through the ASOS app itself during the incident. (NCSC,2026)
Good cyber security therefore isn’t only about firewalls, devices and networks. It’s about people, identities, platforms and the decisions we make when something lands in front of us.
Because sometimes an attacker doesn’t need to smash through the technology protecting the front door.
They just need someone to believe they belong on the other side of it.
There’s a lot businesses can take away from the ASOS story, but perhaps the biggest lesson is that resilience isn’t something you want to start thinking about after something goes wrong. Whether it’s your systems, security, data or continuity plans, having the right foundations can make a difficult situation much easier to navigate. That’s where String comes in. We help businesses build technology that works on the good days and is ready for the not-so-good ones too.
Sources
ASOS (2026) Latest ASOS Security Incident Update: Customer Information & FAQs. Available at: ASOS Customer Care (Accessed: 26 October 2026). ASOS confirms the impersonation of a trusted contact, compromise of employee login credentials and subsequent access to information on third-party platforms.
National Cyber Security Centre (2026) Incident affecting ASOS customers. Published 6 October 2026. Available at: National Cyber Security Centre (Accessed: 26 October 2026). National Cyber Security Centre provides details of the unauthorised push notification and guidance for affected customers.
Verizon (2026) 2026 Data Breach Investigations Report. Available at: Verizon Business (Accessed: 26 October 2026). Verizon examines contemporary breach patterns including social engineering and AI-assisted cyber activity.