ASOS confirms customer data breach linked to compromised employee credentials

The NCSC has confirmed that UK fashion retailer ASOS is investigating a cyber incident in which some customer personal information may have been accessed. Infosecurity Magazine reports that the breach was linked to stolen employee credentials, and that the attackers gained access through the compromise of Simon AI, an agentic marketing platform used by ASOS. The attackers reportedly alerted ASOS customers directly through a rogue push notification sent via the company's mobile app, stating they had "fully compromised" the retailer's cloud storage. ASOS has confirmed it is working with law enforcement and cybersecurity specialists to investigate the incident and assess the scope of data accessed. The incident has raised questions about how third-party platforms with access to customer-facing systems and data are secured and monitored.

Why this matters for UK organisations

This incident illustrates how supply chain compromise, particularly of third-party platforms with access to customer data or internal systems, can create direct and highly visible risk to UK businesses and their customers. The fact that attackers were able to send a notification through ASOS's own app suggests they gained significant access to backend systems, likely through compromised credentials rather than a technical vulnerability in ASOS's own infrastructure. For many organisations, marketing platforms, customer engagement tools, analytics services and content management systems sit outside the core IT estate but often hold privileged access to customer data, cloud environments or communication channels. When these platforms are compromised, the impact can be immediate, difficult to contain and highly damaging to customer trust. The ASOS incident is a reminder that third-party risk is not just about data processors or IT suppliers, but also about the operational tools that marketing, customer service and digital teams rely on daily. These platforms may not always be subject to the same security scrutiny as core infrastructure, yet they can represent a significant attack surface.

What to review

UK organisations should review what access third-party platforms have to customer data, internal systems and communication channels such as email, SMS or push notifications. Consider whether privileged access is appropriately scoped, whether credential hygiene and multi-factor authentication are enforced for third-party integrations, and whether monitoring is in place to detect unusual activity from trusted platforms. Organisations should also consider whether they have visibility of which third-party tools are in use across marketing, customer engagement and digital teams, and whether these tools are included in third-party risk assessments and vendor security reviews. Where platforms have the ability to send communications directly to customers or access sensitive data, consider whether additional controls, logging or approval workflows are appropriate. This is also a prompt to review whether incident response plans account for compromise originating from a trusted third-party platform, and whether communication protocols are in place to respond quickly and transparently if customer-facing systems are affected.

Source: NCSC UK and Infosecurity Magazine