[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-4OyTGwBhdnqOkOE3ul8qxf3FlbS_Rs4xvmrssQApl8":3},{"article":4,"iocs":44,"watch_terms":48,"solutions":49,"lesson":130},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"37d9bb68-51c4-4555-8f80-85e273a07ebc","ASOS links data breach to social engineering attack, credential theft","asos-links-data-breach-to-social-engineering-attack-credential-theft-e7ebdb","ASOS is sending updates to affected customers about the cybersecurity incident it suffered earlier this week, confirming that hackers accessed some personal data. [...]","UK fashion retailer ASOS has confirmed a data breach resulting from a social engineering attack where hackers impersonated a trusted contact to steal an employee's login credentials. These credentials were then used to access personal data and contact details on third-party platforms, though payment information and passwords were not compromised. The company is working with external experts and law enforcement, and has implemented additional security measures.","ASOS confirms data breach due to social engineering attack and credential theft.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fasos-links-data-breach-to-social-engineering-attack-credential-theft\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F06\u002Fasos-logo.jpg","2026-10-08T11:42:46+00:00","2026-10-08T12:00:09.139442+00:00",7,[17,20,23],{"name":18,"type":19},"ASOS","vendor",{"name":21,"type":22},"Xuanye Group","threat_actor",{"name":24,"type":25},"social engineering","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":26,"icon":28,"name":29,"slug":30},null,"Breaches","breaches",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":46,"value":21,"context":47},"malware","Threat actor claiming responsibility for the attack",[18],{"controls":50,"vendors":129},[51,80,103],{"slug":52,"name":53,"problem":54,"products":55},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":81,"name":82,"problem":83,"products":84},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[85,93,98],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":94,"product_name":95,"url":96,"description":97},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":99,"product_name":100,"url":101,"description":102},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":104,"name":105,"problem":106,"products":107},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[108,114,122],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":109,"product_name":110,"url":112,"description":113},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":123,"product_name":126,"url":127,"description":128},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":131,"title":132,"body":133,"framework_refs":134,"framework_notes":146},"asos-breach-shows-social-engineering-remains-a-critical-human-vulnerability","ASOS Breach Shows Social Engineering Remains a Critical Human Vulnerability","A hacker successfully impersonated a trusted contact to trick an ASOS employee into surrendering their login credentials, which were then used to access personal data on third-party platforms. This breach illustrates that even well-resourced organisations remain vulnerable when employees lack the training to verify identities before sharing or acting on sensitive requests. The incident highlights the compounding risk of credential-based access without strong multi-factor authentication — once credentials are stolen, attackers can move laterally into connected systems with relative ease. The exposure of customer contact data, even without payment details, still creates significant phishing, fraud, and regulatory risk for affected individuals.",[135,136,137,138,139,140,141,142,143,144,145],"CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 16 – Application Software Security","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 IA-2 – Multi-Factor Authentication","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 SI-4 – System Monitoring","GDPR Article 5(1)(f) – Integrity and Confidentiality","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","NIST CSF PR.AT-1 – Awareness and Training",{}]