20 October 2026 · By Chris Kirby

The Asos data breach: what it teaches UK small businesses

Earlier this month, millions of people who use the Asos app got a pop-up notification they weren't expecting. It was headed "ASOS HACKED", and it came from the criminals who had just broken in, using the retailer's own app to announce it.

It's a big-brand story, but the way it happened, and what's likely to follow, is something every small business that holds customer details should understand.

What happened at Asos

On Tuesday 6 October 2026, cyber criminals used Asos's own app system to send a pop-up message to customers. Asos then told the London Stock Exchange that the message had been sent by an "unauthorised third party", and that "basic personal information including name and contact details may have been accessed" (BBC News; SME Magazine).

The picture soon got worse. The criminals contacted the BBC with a sample of the stolen data, and Asos then told customers that the hackers had much more than basic contact details. According to the BBC, they hold names, addresses, phone numbers, email addresses, customer numbers and dates of birth, along with the searches people had made on the site. Asos said no bank details or passwords were taken (BBC News).

How they got in: a borrowed identity

The most useful detail for small businesses is how it started. Asos told customers that the hackers got into an employee's account by "impersonating a trusted contact to obtain log in credentials". With that one login to a service Asos hasn't named, they were able to download customer data (BBC News).

In other words, nobody needed to crack a clever piece of security. Someone pretended to be a person the employee trusted, and asked for the keys.

If that sounds familiar, it's because it keeps happening. Our post on the £20m Arup deepfake scam was about the same basic trick. The government's latest Cyber Security Breaches Survey found phishing was by far the most common type of attack on UK businesses, reported by 38% of them, and 42% of micro businesses reported a breach or attack of some kind in the last year (GOV.UK).

Your data doesn't only live on your computer

The second lesson is quieter but just as important. The Asos breach involved "third-party platforms" the company uses to talk to its customers, not its main website. The criminals claimed they had got in through a data platform built on top of a cloud data service called Snowflake. That service said its own platform had not been breached (BBC News).

Most small businesses work the same way, just on a smaller scale. Your customer list might sit in an email marketing tool, a booking system, an online shop, an accounting package and a shared spreadsheet, each with its own logins. Every one of those is a door, and a criminal only needs one person to open one of them.

It's not just one retailer, either. Less than a week later, TFG London, which owns Hobbs, Whistles and Phase Eight, said its websites and IT systems had been hit by a cyber attack, paused online orders, and said it was investigating whether personal data had been taken (The Guardian).

The breach is only the start

Here's the part that matters most to customers, and to any business whose name they trust. Stolen personal details are raw material for the next scam.

The BBC noted that with this information, scammers may be able to write convincing phishing emails or make convincing phone calls. Asos warned customers to "remain cautious of unexpected messages or calls claiming to be from Asos". One security expert quoted by the BBC said to expect scammers to mention the attack, use people's personal details to seem genuine, and create urgency, such as threatening to lock an account within 24 hours (BBC News).

Think about what that means for a small business. If a criminal knows your customers' names and email addresses, the next step is an email that appears to come from you: an "updated bank details" message, a fake invoice, or a "please confirm your account" link. Whether that email can actually be made to look as if it came from your own address depends partly on settings attached to your domain name, known as SPF, DKIM and DMARC. The NCSC recommends them because they make it much harder for someone else to send email in your name.

If it happens to you

Small businesses have legal duties too. If you lose personal data and it's likely to put people at risk, the ICO says you must report it without undue delay, and within 72 hours of becoming aware of it. The clock starts when you discover the breach, not when it happened, and the ICO has a simple guide for small organisations on what to do in those first hours (ICO).

It's far easier to think about this on a quiet afternoon than in the middle of an incident. Knowing where your customer data lives, and who can log in to each place, is a good start.

Where do you stand?

You can't stop criminals targeting your staff or your suppliers. But you can make sure your own domain isn't an easy tool for them, so that if your customers' details ever end up in the wrong hands, it's harder for anyone to email them pretending to be you.

Tidy Cyber's free check looks at your domain from the outside and tells you, in plain English, whether your email spoofing protection is in place, along with your website security, certificate and domain basics. If you want to understand what the results mean, our DNS help guides cover the email settings for the most common domain providers. Run the free check on tidycyber.co.uk and find out where you stand in a couple of minutes.