9 October 2026
ASOS Hacked
9 October 2026
On Tuesday morning, ASOS customers picked up their phones to find a notification from the official ASOS app announcing that the retailer had been hacked. It was written by the attackers themselves, who claimed to have taken customer data and told ASOS to get in touch or see it leaked. The share price fell by around a tenth within hours.
ASOS says it is investigating unauthorised activity on the third-party platforms it uses to message customers. Names and contact details may have been accessed. It does not believe passwords or card details were. How the attackers got in has not been made public.
Two in a week
This comes days after the story of Faav, the 16-year-old who gained administrator access to an internal Microsoft system by changing one username to "admin". Two household names, one week, and no sign of the cinema version of hacking in either.
Most "hacks" aren't hacks
When a big company is breached, we picture someone in a hoodie breaking codes. The reality is usually duller. Somebody logs in with a password stolen elsewhere, or a supplier's account is left open, or somebody simply asks.
Marks & Spencer is the clearest example. In 2025, attackers rang an IT help desk, pretended to be a member of staff and talked their way into a password reset. That phone call cost M&S weeks of lost online trading and an estimated £300 million in profit.
Nobody broke in. A person was persuaded to open the door for a voice they trusted.
It can happen to you, so what are your protocols?
- Who can reset a password, and how do they check who is asking? If the answer is "they ring up and we do it", that is your gap.
- Do you call back? When a supplier, your accountant or the boss phones or emails with an urgent request to change bank details or grant access, hang up and ring a number you already hold.
- Is there a second check on everything? Two-step verification on email, banking, your website and your marketing tools.
- Who else holds your keys? ASOS was reached through platforms run by other companies. List every contractor and system that can reach your customers or their data.
- Does your team know they are allowed to say no? Impersonation works because people are helpful and feel rushed. Give staff permission to slow down and check.
- Do you practise it? A ten-minute conversation every quarter beats a policy nobody has read.
If Microsoft and ASOS can be caught out, so can a ten-person firm. You do not need their budget. You need a short list of plain rules that everyone, including you, actually follows.