The ASOS Attack Fallout and Incident Governance Challenges

By Kate O'Flaherty • 12 November 2026 • 6 min read

The recent ASOS attack and resulting fallout demonstrates the governance challenges during a live incident when firms are still trying to establish the facts. What lessons can be learned?

In October, ASOS app users received a notification stating that the firm had been hacked.

“ASOS HACKED,” the alarming notification read. “Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it,” the text continued.

It led to mass confusion, made worse by the fact that ASOS remained silent, leaving customers and internal staff in the dark for hours.

When Aimee Leake, senior compliance success manager at IO, received the pop up, she didn’t know who to trust. “I found myself looking elsewhere online for answers, rather than relying on the app itself,” she says. “Once I’d realised that I was one of many who had received the notification, I was relieved. But I was also concerned at how big the problem could potentially be, given the rate of other recent cyber-attacks.”

ASOS eventually sent out an email to customers, confirming the pop-up was sent by an unauthorised third party. Yet it was too late for the many customers who may have lost their trust in the retailer. What lessons can be learned?

Governance Challenges

The ASOS attack fallout demonstrates the governance challenges during a live incident when firms are still trying to establish the facts. When Leake contacted ASOS to find out what was happening, she didn’t feel reassured by the responses. “There wasn’t much clarity around what had actually happened, and it felt like the people responding didn’t have all the information themselves.”

Sam Peters, CPO at IO, believes one of the most difficult decisions in this type of incident is what to communicate when you don’t yet have the complete picture. “Silence creates uncertainty, but premature assurances can further damage trust.”

The incident was unusual because criminals used the online retailer’s own system to send the pop up to millions of people after duping an employee by posing as a “trusted contact”.

Like ASOS, many organisations may not have considered what happens if they can’t use previously assumed safe comms channels. Indeed, most incident response plans concentrate on losing access to systems. “Far fewer test what happens when a system is still functioning but can no longer be trusted,” says Tom Lovell, head of security services, Infinity Group.

A useful principle is to assume no customer communication channel should be inherently trusted simply because it belongs to the organisation, says Lovell. “Businesses should map email, SMS, apps, websites, contact centres and social accounts as part of their threat surface, then determine how messages can be independently verified if one of them is compromised,” he advises.

IO has contacted ASOS for a comment, but the retailer has not replied at the time of writing.

Artificial Boundaries

A live incident such as the ASOS attack brings security, privacy, supplier management, customer comms, regulatory obligations and leadership decisions together at the same time. It also exposes the “artificial boundaries” businesses create between these areas, says Lovell. “Security needs to establish access and containment. Privacy needs to understand what information has been exposed. Supplier management needs evidence from technology partners. The organisations best prepared for this will have rehearsed how those functions make decisions together when the evidence is incomplete.”

But at the same time, these moving parts must be coordinated under pressure. Coordination requires “a single source of truth” and a “dedicated incident commander”, points out Dray Agha, senior manager, tactical response at Huntress. “You must separate the people fixing the technical problem from the people managing the wider business impact. The technical team needs space to investigate without fielding constant questions. The management team must focus purely on communication and business continuity based on brief updates from the incident commander.”

One practical idea is to maintain an “incident fact register”, Lovell suggests. “Every material claim is classified as confirmed, suspected or disproven, with its supporting evidence and an owner. Security, legal, privacy, communications and leadership then work from the same picture rather than maintaining competing versions of events.”

Lessons Learned

The ASOS incident offers several useful lessons for security and compliance leaders. Leake thinks the online retailer could have been much more transparent from the start. “Even if they didn’t have all the answers, acknowledging the situation properly and providing meaningful updates would have made a difference.”

Experts concur. The incident highlights the importance of “pro-active and transparent communication” about cyber-attacks, says David Varney, digital partner at law firm Womble Bond Dickinson.

With this in mind, customer communications need to be part of incident planning for businesses as part of their cyber strategy, advises Varney. “If a channel that customers normally trust is affected, businesses need another reliable way to reach customers and explain which messages are genuine.”

IO’s Peters emphasises the importance of preparing for decisions before an incident occurs. Companies need clear ownership and escalation routes, according to Peters. “This ensures everyone understands who can make decisions, when senior leadership needs to be involved and how security, privacy, suppliers and communications teams coordinate their response. You don’t want to be making these sorts of decisions under pressure, with everything coming at you during a live incident.”

It is also important to maintain a clear record of all the decisions made during an incident, documenting the evidence and actions as the situation develops, says Peters. This is particularly key when assessing any regulatory obligations that might apply and to demonstrate accountability afterwards.

Established Frameworks

Incidents such as the ASOS attack are where Peters strongly believes established frameworks such as ISO 27001 and ISO 27701 deliver their value. “They provide the structure for managing security and privacy risks, with documented processes, clear responsibilities and mechanisms to track and improve performance. These foundations help teams coordinate their response, understand their obligations and make informed decisions under pressure.”

Crucially, Peters thinks testing and preparation through tabletop exercises should go beyond technical containment. “They should explore what happens when things like trusted communication channels fail, or a supplier is involved, or regulatory reporting decisions have to be made with incomplete information,” he advises. “Organisations can then use the findings, alongside lessons from real incidents, to strengthen their controls, processes and preparedness over time.”

Infinity’s Lovell believes firms should measure incident response in terms of trust as well as recovery. “A system can be technically restored long before customers are confident enough to trust it again. Security leaders should therefore ask two questions after an incident: ‘When did we regain control?’ and ‘when could our customers reasonably know that we’d regained control?’ Those are not necessarily the same moment.”