The ASOS hack wasn't clever, it was basic cybersecurity

ASOS customers got a ransom note from their own app. Here's what actually happened, and why an SME hit by the same attack would come off far worse.

Phone with brand logo on it laying on a desk

On the morning of 6 October, millions of ASOS customers unlocked their phones to find a push notification waiting. It wasn't a sale. It wasn't a delivery update. It was a ransom demand, addressed to ASOS's data protection officer and IT team, claiming their Snowflake data environment was "fully compromised" and threatening a leak if they didn't engage.

The message had been sent from inside ASOS's own marketing tools, and customers were reading it before ASOS's own team had a chance to respond. The company confirmed names and contact details may have been accessed, that card details and passwords appear to have been safe, and that the site stayed up throughout. Their share price dropped more than 10% that day.

Here's what's worth understanding about how it happened, and why the same attack landing on a Scottish SME would be a very different conversation.

How it actually happened

ASOS's official statement is that an employee was tricked into handing over login credentials. Someone impersonated a trusted contact. The employee believed them. That was enough.

The attackers didn't break in. They had credentials that weren't protected, and used them. They got into the Snowflake environment, but our read is that they found keys to multiple systems, not just one door. The marketing platform, the push notification tool, all of it appears to have been accessible under those credentials.

This is how most breaches like this work. Not a sophisticated technical exploit. A login. And if MFA isn't switched on, a login is all it takes. In 2024, the same approach compromised more than 160 companies' Snowflake accounts, and ASOS appears to be the latest.


But what does this mean for an SME?

ASOS has a full internal IT team. When the push notification fired, they had people who could immediately start containment, bring in external experts, brief the ICO, and coordinate with the NCSC. The damage, bad as it was, was limited, and there's a clear reason for that.

MFA across every platform is one of the first things we check when we start working with a new client. Not just Microsoft 365: every app, every platform with an external login. We find gaps consistently: a marketing tool someone set up three years ago, an analytics platform with credentials that haven't been reviewed since a staff member left, an old agency login that's been sitting there since a rebrand.

But the bigger difference isn't the IT team. It's the brand.

ASOS will recover. It's one of the UK's biggest online fashion retailers, customers have annual delivery passes, years of order history, wishlists, habits built over a decade. Brand loyalty absorbs a significant amount of damage. An SME doesn't have that buffer. A breach that exposes customer data doesn't just cost money, it costs trust. And unlike ASOS, most businesses don't have the brand depth to bring customers back once that trust is gone. For an SME, that's not a bad year. That's potentially business over.

The data risk is different too. ASOS believes card details weren't accessed. An SME with no proper security controls in place is more likely to see attackers get much further, into payment data, customer records, information that creates serious liability under GDPR. ASOS had an IT team containing the damage as it happened. Without that, the breach runs until someone notices.

The two things giving SME businesses false security

We see two patterns regularly when we talk to clients about this type of attack.

The first is the assumption that enterprise or expensive software comes with protection built in. It doesn't. Snowflake is a well-regarded platform. ASOS was using it. The breach wasn't Snowflake's fault: it was the credential that unlocked the account. The software your business uses is only as secure as the access controls you've put around it. Following a big company onto an enterprise platform is not a security strategy.

The second is the break-fix IT retainer. Businesses on a "call us when something goes wrong" arrangement often assume this means they're protected. They're not. Break-fix picks up the damage after the attack. The Monday morning call telling your IT provider that your systems are encrypted or your customer data has been accessed is not a security plan. It's the moment the plan has already failed.

What to check today

We put out a LinkedIn post on this after the ASOS story broke, covering five things worth checking now:

  1. MFA on every app, not just Microsoft 365
  2. Remove old staff and agency logins you no longer need
  3. List your API keys: who created them, what can they access
  4. Have a plan for reaching customers if your own channel is compromised
  5. Have an incident response plan your team has actually read

The last two are the ones most businesses haven't thought about. The first three are where we find the gaps most often.

If you want to know whether your business has the same vulnerabilities that appear to have let attackers into ASOS, book a call with our team.

-

Sources: