On 6 October 2026, online retailer ASOS confirmed a cyberattack in which customer information was accessed after an attacker obtained an employee’s login credentials.
Everything we know about the incident comes from public sources: ASOS’s own statements, the National Cyber Security Centre and press reporting. ASOS’s investigation is ongoing, we have no visibility into its findings beyond what the company has shared, and nothing in this article should be read as a judgement on ASOS or the people involved. Even so, we could not resist looking at the event through the lens we apply every day. Any incident, in any sector, raises two questions beyond its immediate impact: what conditions made it possible, and how much worse could the consequences have been? Asking them is the part of incident investigation that leads to prevention.
.webp)
What happened at ASOS?
• 6 October 2026: ASOS customers received an unauthorised notification through the retailer's app.
• Following the incident: ASOS confirmed that an attacker had impersonated a trusted contact to obtain an employee's login credentials, which were used to access information held on third-party platforms.
• Information accessed: Names, contact details and certain non-personal account information were affected. ASOS confirmed that payment-card details and account passwords had not been accessed, and that its website and app remained safe to use.
• Action taken: ASOS restricted access to the affected platforms and launched an investigation involving internal and external cybersecurity specialists, alongside relevant authorities.
The investigation remains ongoing, with the full extent of the incident and its consequences yet to be established. The summary above reflects what ASOS and the NCSC had published at the time of writing, and it may change as the investigation progresses.
On the public record, ASOS’s response reflects good practice. It confirmed the incident within days, was specific about what had and had not been accessed, restricted access to the affected platforms and brought in external specialists and the relevant authorities. That openness is what allows the rest of us to learn from the event, and it is the reason this article can be written at all.
A contained attack can still expose serious risks
The ASOS incident involved an actual breach, with customer information accessed and an unauthorised notification sent. It should not be described as a near miss.
However, it raises an important question about learning from incidents: what could have happened if the circumstances had been different?
More extensive data theft, compromised payment credentials and prolonged disruption to trading have not been reported in this case. But considering these potential outcomes can help organisations understand where vulnerabilities may exist. Access to contact information can create opportunities for convincing phishing attempts. In any organisation, unauthorised access to third-party platforms raises questions about identity controls, access permissions and how quickly suspicious activity can be detected. We do not know how ASOS’s controls performed, and that is a question only its investigation can answer.
Establishing the damage caused is only part of the objective. The more valuable question is what prevented a more serious outcome, and whether those safeguards would hold again.
What could a failure like this cost in retail?
The UK retail sector has already seen how quickly cyber incidents can affect everyday operations. Following its 2025 attack, Marks and Spencer suspended online orders and estimated a £300 million impact on operating profit before mitigation and other offsets. Co-op also experienced major disruption and later reported an estimated £107 million impact on profitability.
The circumstances of these attacks differ from the ASOS incident, and nothing reported so far suggests ASOS faces disruption on that scale. Their value as comparisons lies in the consequences: when essential systems are interrupted, the impact can extend to sales, customer service, supply chains, recovery costs and confidence in the business.
JD Sports provides another relevant comparison. In 2023, the retailer disclosed unauthorised access to historical online order data potentially affecting around 10 million customers. This illustrates how exposure of personal information can become a significant incident even without a prolonged shutdown.
Why understanding what happened isn't enough
ASOS has confirmed that its investigation involves internal and external cybersecurity specialists. This work is essential to establish what happened, identify affected systems and contain any ongoing threats. We have no insight into the scope of that work, and the questions below are the ones we would ask of any incident, in any sector, rather than a commentary on ASOS. Understanding how an attack happened is only one part of learning from it.
A thorough investigation also examines the wider conditions that allowed an incident to occur. How was an individual deceived? Were access permissions appropriate? Which safeguards worked, and where were the weaknesses? How did people, processes and third-party systems contribute?
These questions can only be answered with evidence, which is why we are not attempting to answer them here.
The UK National Cyber Security Centre's guidance on lessons learned encourages organisations to look beyond immediate causes, identify systemic weaknesses and consider how incidents could have developed differently.
This approach is already familiar across high-risk industries, where effective investigations look past individual actions to the conditions that made a failure possible.
From investigation to prevention
An investigation should do more than establish what happened. Its findings should lead to action that addresses underlying causes and reduces the risk of similar incidents happening again.
This means looking beyond the immediate cause to understand the wider factors involved. In cyberattacks involving deception, focusing solely on the employee affected can mean overlooking weaknesses in processes, communication, access controls and system design.
COMET Investigate combines AI-powered incident investigation with structured root cause analysis, helping organisations gather evidence, identify contributing factors and uncover systemic weaknesses. This allows investigation findings to be turned into targeted preventive actions.
We are also developing a dedicated cyber investigation lens, with language and terminology tailored to cybersecurity incidents. This will bring COMET's established investigation methodology into a cyber-specific context, helping organisations identify underlying causes and strengthen their defences.
Don't wait for a more serious incident
The ASOS investigation is still ongoing, and the full picture may look different once it concludes. The broader lesson holds regardless: an incident does not need to cause major disruption to expose serious risks.
Whether it's a cyberattack, equipment failure or safety incident, understanding what went wrong is only the starting point. The real value comes from identifying weaknesses, strengthening safeguards and taking action before a more serious incident occurs.
An investigation earns its value through what it prevents, so the learning from one incident should be put to work before the next one arrives.
Sources
ASOS – latest official incident update
NCSC – incident affecting ASOS customers
The Guardian – ASOS customer data accessed, 8 October 2026
NCSC – Cyber Assessment Framework
M&S – Full Year Results for the 52 Weeks Ended 29 March 2025
Co-op – Co-op navigates headwinds and looks forward with confidence, clarity and purpose
JD Sports – historic orders incident
.webp)
