Asos says hackers tricked an employee into handing over their work account login

British online fashion retailer ASOS disclosed on October 8 that a cyber security breach earlier in the week had compromised certain customers' personal information, including names and contact details, according to its preliminary findings. The company reported that hackers also accessed "certain non-personal account-related information" but no payment card information or account passwords, according to an email sent to customers.

ASOS explained that an unauthorized individual gained access to an employee's account by impersonating a trusted contact to obtain login credentials. These credentials were then utilized to access data on specific third-party platforms used by ASOS. The company stated that the affected platforms were promptly isolated, preventing any further data access.

ASOS reassured customers that its website and app remained secure and continue to be safe for use. The retailer is collaborating with relevant law enforcement and regulatory authorities. ASOS shares rose 3%, offsetting losses for the week to 8%. Social engineering tactics, where hackers masquerade as employees to infiltrate companies' computer networks, are common.

In recent years, British companies and institutions have frequently fallen victim to aggressive and frequent cyber and ransomware attacks. Notable victims include the British Library, blood testing services, the London Underground, Marks & Spencer, the Co-op, and Jaguar Land Rover, all of which experienced months of disruption due to such breaches, as reported by Reuters.