Publish Date: 09 October 2026
From ransomware and data theft to increasingly sophisticated impersonation and social engineering attacks, cybercriminals continue to evolve their tactics in an effort to bypass traditional security controls. The latest reported incident involving online fashion retailer ASOS provides another example of how modern threat actors are targeting people, processes and trusted relationships as much as technology itself.
According to reports, the incident first came to public attention when ASOS customers received notifications through the retailer’s app claiming that hackers had breached company systems. The messages were later confirmed to have been sent by an unauthorised third party that had gained access to internal systems.
ASOS subsequently confirmed that customer information had been accessed following the compromise of an employee account. According to the company, the attacker was able to obtain employee login credentials through an impersonation attack targeting a trusted contact.
Information reportedly accessed included customer names, addresses, email addresses, telephone numbers, customer reference numbers and dates of birth. ASOS stated that payment card details and account passwords were not compromised.
A Sign of a Changing Threat Landscape
Cases like this show how cyber threats continue to evolve. Rather than attempting to break through technical defences, attackers are increasingly using impersonation, social engineering and credential theft to gain access through legitimate user accounts.
By reportedly obtaining legitimate credentials through impersonation, the attacker was able to bypass many of the security controls organisations rely on to protect systems and data.
The incident also demonstrated how threat actors are becoming more creative in their approach. By using customer communication channels to amplify the incident publicly, the attacker was able to increase the visibility of the breach while placing additional pressure on the organisation.
Cybercriminals Are Operating More Like Businesses
Today’s cyber threat groups are often highly organised, well-resourced and commercially motivated.
Rather than relying on a single attack method, they frequently combine techniques such as social engineering, credential theft, reconnaissance and extortion to maximise their chances of success.
Many operate with clear objectives, established processes and constantly evolving tactics, making the threat landscape increasingly complex for organisations of all sizes.
Why Businesses Need to Focus on Resilience
The ASOS incident serves as a reminder that cyber security is no longer solely about preventing attacks.
While preventative measures remain essential, organisations must also consider how they would respond if an attacker successfully gained access to their systems.
Key areas businesses should regularly review include:
- Multi-factor authentication across critical systems
- Employee cyber security awareness training
- Continuous monitoring and threat detection
- Incident response planning
- Secure backup and recovery capabilities
- Disaster recovery and business continuity procedures
The team at Extech Cloud helps make sure all these elements are covered. That’s because effective cyber resilience requires a layered approach that combines strong security controls with well-tested response and recovery plans. And as cyber threats continue to evolve, organisations must ensure their security and resilience strategies evolve with them.
Learn more about Extech Cloud’s cyber security services.
Source: https://www.bbc.com/news
