ASOS's breach started with someone pretending to be a trusted contact
On 6 October, ASOS app users received a push notification reading “ASOS HACKED”. It claimed the attackers had compromised ASOS's cloud data and linked to a Telegram account.
ASOS told shareholders that an unauthorised third party sent the notification and that names and contact details may have been accessed. It has since confirmed the exposure.
The BBC reports that the breached data includes names, addresses, phone numbers, email addresses, customer numbers, dates of birth, and the searches customers made on the ASOS website.
ASOS says no bank details or passwords were accessed. It hasn't said how many customers are affected, and its investigation continues.
The attacker impersonated a trusted contact of an employee to obtain that employee's login. With that account, the attacker reached third-party platforms ASOS uses to communicate with customers. Reports say the same access let the attacker send the notification.
ASOS hasn't said who was impersonated, whether the approach came by email, phone, or message, or whether multi-factor authentication was switched on. The attackers claimed to have breached the Snowflake data platform. Snowflake says its platform wasn't breached, and ASOS hasn't confirmed the claim.
What to check in your own business
The attacker got in with a believable message and one employee's login. Most small businesses hold the same kind of customer data in their email marketing, text messaging, or customer database tools, and a single account can reach all of it.
- When someone asks for a login, a code, or access, do your people contact them on a number they already hold, not the one in the message?
- Do you know who has admin access to the tools that hold customer data or send messages in your name, and who can download your customer list?
Our Phishing Simulations put a realistic, convincing request in front of your own team in a safe setting, so you find out how they'd respond in a real event.
Read our full breakdown of the ASOS breach.
A critical WordPress flaw was under attack within hours of its fix
WordPress released version 7.1.2 on 22 September to fix CVE-2026-87902 (the flaw's public tracking number), a flaw in how WordPress picks which page template to load. WordPress rates it critical, at 9.2 out of 10.
Security firm Previdian recorded the first attack attempt at 11:49 UTC on 22 September, within hours of the release. By 25 September, the US cyber agency CISA had added the flaw to its list of known exploited vulnerabilities.
A crafted web request tricks WordPress into loading a different PHP file from elsewhere on the server. Attackers are pointing it at a standard server tool called pearcmd.php to write new files that give them a back door.
Whether an attacker can take full control depends on the theme and the server set-up. The attack needs no login or click, and scans are widespread, so treat any unpatched site as a target.
What to check in your own business
Many WordPress sites update themselves, and Previdian expects mass attack attempts but few successful compromises. The sites most likely to be behind are the ones where nobody owns updates, such as sites built by a freelancer years ago and old campaign pages.
- Is your site on version 7.1.2, or the matching security release for your branch (7.0.6, 6.9.9, or 6.8.10), and are automatic security updates switched on?
- Can you name who is responsible for updates on each of your websites, including old campaign sites and test copies?
Our Vulnerability Scan checks your internet-facing websites every day for outdated software like vulnerable WordPress versions, and tells you what to fix first.
Read our full guide to the WordPress flaw, including how to check for planted files.
P&O Ferries sent a passenger list to the passengers on it
On the morning of Monday 31 August, passengers on one Calais to Dover sailing received a text message from P&O Ferries. It told them to view an attachment for their latest update.
Press reports say the link opened a spreadsheet listing the passengers on the crossing, with names, customer IDs, booking numbers, email addresses, and phone numbers.
P&O Ferries called it an isolated incident, apologised, and said it was contacting affected customers directly. It describes the link as inadvertently shared.
The Information Commissioner's Office (ICO), the UK data protection regulator, says P&O reported the incident and that it is assessing the information provided. P&O hasn't published the cause, but its own description points to an error.
What to check in your own business
Any business that sends bulk emails or texts, or shares links to customer lists, can make this mistake. A single wrong attachment reaches everyone on the distribution list at once.
Under UK GDPR, a breach that puts people at risk has to be reported to the ICO within 72 hours of you becoming aware of it.
- Does anyone check the recipient list and the attachment before a bulk message goes out?
- If you share a customer list by link, can you see who has opened it and switch the link off?
Our Security Awareness Training includes data security modules that help your team handle customer information safely.
Three stories, three starting points
This month’s three stories each started somewhere different.
One was a person pretending to be someone an employee trusted. One was a software flaw that attackers used within hours of the fix. One was a message sent to the wrong people.
Each one calls for a different check: how you verify a request, who owns your updates, and who approves a bulk message.
Find out where you'd stand
See how your organisation would fare in similar circumstances with a free HackRisk Report. It's completely free and arrives within 24 hours.