On Tuesday 06 October, digital fashion retailer ASOS confirmed that a hacking incident had accessed basic personal information including names and contact details.

The ASOS website and app still operated as normal, with no current disruption to any aspects of operations. However, news of the security breach sent shares plummeting 11 per cent in Tuesday morning’s trading.

ASOS has since revealed that an unauthorised party gained access to an ASOS employee account. It stressed: “The affected platforms were immediately locked down, ensuring that no further information could be accessed and a full investigation was launched with the support of both internal and external cyber experts.”

Many cyber experts have already had their say.

Marty Bauer, ecommerce expert at Omnisend, responded: “What makes the ASOS incident so damaging is that it came through the push notifications customers had chosen to receive. For an online fashion retailer, that channel is part of the shopping experience itself, alongside checkout, order updates, email and returns.

“Once shoppers start questioning whether those messages can be trusted, the commercial damage spreads well beyond the day of the incident.

“If an incident makes shoppers switch off notifications, stop opening emails or hesitate before logging in, the retailer loses future purchases as well as sales on the day. That matters because automated push is one of ecommerce’s best-performing channels.”

Jonathan Lee, director of cyber strategy at TrendAI, commented: “This is the cyber equivalent of hijacking a shop’s Tannoy and announcing a breach to every customer in the store. The attackers appear to be targeting customer trust as much as the technology itself. What’s unusual is not just the alleged breach, but the way that it has been disclosed.

“The focus from ASOS should now be on strengthening the controls around access to platforms that hold customer information like Snowflake. That includes putting in place phishing-resistant multi-factor authentication, restricting access by device and location, reducing unnecessary privileges and monitoring for unusual behaviour.

“Large-scale data access, unusual user activity and access from unexpected locations should all stand out long before a customer sees a message such as this one. There is also a strong case for reducing the amount of data that is retained in such platforms.

“Organisations should regularly review what they store, how long they keep it and whether it’s needed. The less sensitive data available to an attacker, the lower the potential impact of a breach.

Eliad Kimhy, senior TRU researcher, Acronis Threat Research Unit (TRU), shared: “Attackers will use whatever means they can to pressure a potential victim, even if they do not have valuable data. Extortion groups have contacted a victim’s customers in the past to increase that pressure, although doing so through the company’s own app is particularly unusual.

“Following an attacker’s instructions is never a good idea. In this case, it might lead to customers being phished or otherwise harmed.

Rob Robie, CEO of software resilience firm Escode, said: “The incident affecting ASOS highlights how much modern online retail has become reliant on third-party technology, much of which is now embedded across the customer journey, from communications through to the systems that support transactions and fulfilment.

“What is often overlooked is the hidden supply chain of technology itself. Retailers may understand their direct providers, but not always the dependencies those providers rely on behind the scenes, where a single point of failure can have far-reaching consequences.”

New data shows account takeover fraud pressure across EMEA has increased 82 per cent year on year by GMV, with $73m (£61.6m) in attempted account takeover fraud blocked across the region in the past 12 months.

Xavi Sheikrojan, senior risk intelligence manager at Signifyd, added: “That is why breaches involving customer information matter beyond the immediate incident. Once personal data is exposed, fraudsters can combine it with credentials obtained elsewhere and use credential-stuffing attacks to try to gain access to legitimate customer accounts.

“For retailers, that creates a particularly difficult challenge because the fraudster is no longer necessarily presenting as an unknown or obviously suspicious shopper. They can be operating through an established account, using genuine customer information and behaviour designed to resemble the legitimate account holder.

“It is too early to attribute any increase in account takeover directly to the ASOS breach, but retailers should expect exposed data to be tested. Following a breach, monitoring for changes in login behaviour, account details, devices, delivery information and purchasing patterns becomes critical to identifying when a genuine customer account may have fallen into the wrong hands.”

Conor O’Neill, co-founder and CEO of penetration testing provider OnSecurity, shared: “Relying solely on the CISO to manage cybersecurity is risky and outdated because cyber threats exploit vulnerabilities across all organisational functions. Accountability must extend beyond a single role, with senior leaders across departments actively involved in managing cybersecurity risks.

“Cybersecurity accountability must be shared across multiple organisational roles. Tech teams deploying applications must embed security controls, developers require guidance on secure coding practices, marketing and data teams should rigorously manage data privacy, and frontline support teams must receive targeted training to combat sophisticated social engineering tactics.

“Retailers must integrate security into everyday business processes, such as DevOps pipelines, procurement procedures, and customer support protocols, to proactively address risks. Security-by-design is crucial to mitigate risks before they escalate into operational crises.”

 Gareth Hoyle, managing director and founder at AI and search marketing agency, Marketing Signals, stated: “For a retailer like ASOS, the inbox and the app are where most of their customer relationship happens. When a push notification from the brand’s own app arrives with a message from the hackers, it lands in the one place shoppers have every reason to trust. This feels very different to a breach people have only read about, because customers have seen it for themselves via their phones and will worry about what it means for their data.

“The longer-lasting damage is likely to show up in search. Many shoppers will be checking whether ASOS is safe to use for a while yet, and Google’s AI Overviews and tools, such as Gemini and ChatGPT, will answer from whatever coverage is out there.

“These tools pull a brand’s recent history into a single answer at the top of the page, and plenty of people will just read this rather than click through to the retailer’s own website for the full statement. These summaries become the first impression, and the more coverage that comes out, the more they’ll have to pull from.

“How a retailer responds to an incident like this matters just as much as the technical fix. A clear, factual update kept current on its own website, with plain answers to questions that customers are most likely asking, gives search engines and AI tools something accurate to cite instead of speculation.”

Jonathan Wright, partner, Hunton Andrews Kurth, noted: “The aim is not to have every answer immediately; it is to establish control, communicate verified facts and give people a reliable source of updates. For ecommerce businesses, where customers interact directly with online platforms, that is also important for maintaining customer trust.

“Centralising data can make it easier to manage and secure, but excessive privileges can turn one compromised identity into a much larger exposure.

“The question is not simply whether customer data belongs in the cloud. It is whether the business has limited what any one account can access, can detect misuse quickly and has a tested way to contain it.”

Click here to sign up to Retail Gazette‘s free daily email newsletter