Asos confirmed a cyber-incident on 6 October 2026, stating that customer data, including names and contact details, may have been accessed. The incident saw app users receive an unauthorised push notification threatening to leak data.
Joe Hancock, Head of Cyber Risk and Complex Investigations at Mishcon de Reya, has been quoted Drapers on the attackers’ approach and the pressure that direct communication with customers can place on businesses.
Joe commented: “It is unusual to see messages addressed to a DPO. Attackers have previously had an adversarial relationship with IT security teams, but may now realise that the data aspects of an attack carry more weight. Pushing the messages directly to customers is also novel, and could be a very effective way for the attackers to apply pressure on Asos.”
On the continuing threat to businesses, Joe added: “Ransom-based attacks and cyber-crime show no sign of receding. While groups believe that organisations will pay, this is likely to continue.”
Read the full article