The ASOS breach highlights how a single compromised employee account can lead to significant business disruption. In this case, attackers reportedly gained access through employee login credentials obtained via impersonation and social engineering techniques, allowing them to access customer information through third-party platforms. It demonstrates that cyber criminals often target people rather than technical systems, making employee awareness and strong authentication controls just as important as firewalls and security software.

Social engineering is the practice of manipulating people into revealing confidential information or granting access. Rather than breaking through technical defences, attackers exploit trust, urgency and human behaviour. Common examples include phishing emails, fake IT support calls, fraudulent payment requests and requests to share login credentials. Because these attacks rely on human judgement rather than technical vulnerabilities, organisations of every size and sector can be affected.

Yes. Smaller businesses are often targeted because attackers may assume they have fewer security resources than larger organisations. However, the techniques used in incidents like the ASOS breach require little sophistication and can be directed at any organisation with employees, customer data, financial information or access to client funds. Professional services firms, charities, manufacturers, retailers and technology businesses are all potential targets.

Password reuse allows attackers to exploit credentials stolen in one breach to access accounts on completely different systems. This technique, often called credential stuffing, is widely used because many people continue to use the same password across multiple platforms. Using unique passwords for every account, supported by a password manager where appropriate, significantly reduces the risk that a breach elsewhere could compromise business systems.

MFA is one of the most effective cybersecurity controls, but it is not a complete solution on its own. While it helps protect accounts if passwords are stolen, attackers may still attempt to trick users into approving authentication prompts or sharing verification codes. Businesses should combine MFA with staff training, phishing awareness, strong password policies, access controls and clear reporting procedures for suspicious activity.

Employees should report the incident immediately. Fast reporting allows IT teams to reset passwords, terminate active sessions, investigate potential access and limit any damage before attackers can move further through systems. Delaying notification out of embarrassment or uncertainty can increase the impact of an incident. Most organisations are better protected when staff report concerns early, even if they turn out to be false alarms.

The legal obligations depend on the nature and severity of the incident. In the UK, organisations may need to assess their obligations under UK GDPR and the Data Protection Act 2018, including whether the breach presents a risk to individuals’ rights and freedoms. Where required, breaches may need to be reported to the Information Commissioner’s Office (ICO) and potentially affected individuals. Businesses should have a clear incident response process in place before a breach occurs.

Effective training focuses on practical behaviours rather than technical jargon. Employees should understand how to verify unusual requests, independently confirm payment instructions, challenge requests for credentials and recognise common warning signs such as urgency, secrecy and unexpected changes in process. Regular awareness programmes, simulated phishing exercises and clear reporting channels can help reinforce good habits across the organisation.

A common misconception is that cyberattacks primarily result from sophisticated hacking techniques. In reality, many successful incidents begin with basic human errors, such as sharing credentials, reusing passwords or responding to convincing phishing messages. Strong technical controls remain important, but organisations that focus only on technology may overlook one of their most important security assets and risks: their people.

Cybersecurity should be reviewed continuously, with formal assessments carried out regularly and after significant business changes. Reviews should cover employee awareness, password policies, MFA adoption, access permissions, third-party providers, incident response procedures and compliance obligations. Organisations operating in regulated industries or handling sensitive personal, payroll or financial data may benefit from more frequent reviews to ensure controls remain effective as threats evolve.

Yes. The consequences can extend far beyond the exposure of personal information. Businesses may face operational disruption, financial losses, reputational damage, regulatory scrutiny, contractual issues and a loss of client trust. In some cases, attackers may use stolen access to commit payment fraud, impersonate the organisation or attempt extortion. This is why cybersecurity is increasingly viewed as a business risk and governance issue rather than simply an IT concern.