ASOS links data breach to social engineering attack, credential theft

A hacker successfully impersonated a trusted contact to trick an ASOS employee into surrendering their login credentials, which were then used to access personal data on third-party platforms. This breach illustrates that even well-resourced organisations remain vulnerable when employees lack the training to verify identities before sharing or acting on sensitive requests. The incident highlights the compounding risk of credential-based access without strong multi-factor authentication — once credentials are stolen, attackers can move laterally into connected systems with relative ease. The exposure of customer contact data, even without payment details, still creates significant phishing, fraud, and regulatory risk for affected individuals.