'Impersonating trusted contact': ASOS provides update after chilling hack

An online shopping giant loved by Australians has revealed how hackers were able to gain access to the platform and what shoppers should do .

A legal expert says employers should design cyber security systems on the assumption that employees could be deceived following an ASOS hack.

Last week, an ASOS employee was tricked into handing over their credentials to a hacker who pretended to be a trusted .

Customers received a chilling hack notification 8pm on Tuesday October 6, that appeared to be from British online shopping giant ASOS warning of a hack.

“Dear ASOS DPO and IT, we have fully compromised the Snowflake instance,” the hackers’ chilling message to the ASOS team read.

“Engage with us, or we will leak it.”

The online shopping giant confirmed some personal information had been accessed during the hack, including names and details, as well as certain non-personal account related information.

A week after the hack, an ASOS spokesman confirmed an unauthorised third party logged into an ASOS employee’s account by “impersonating a trusted ” to obtain the log-in details.

“The affected platforms were immediately locked down, ensuring that no further information could be accessed and a full investigation was launched with the support of both internal and external cyber experts,” they said.

ASOS serves 16.7 million active customers, with Australia one of the largest international markets for the e-commerce platform.

It is not known how many customers were impacted by the hack.

Further investigations into the hack found that no payment card information or password details were accessed.

“The ASOS website and app were safe to use throughout, and remain safe to use today,” the update read.

“There is no action you need to take on your account. However, please remain cautious of unexpected messages or calls claiming to be from ASOS.”

LegalVision practice group leader Joel Hayden said social engineering attacks work because they exploited trust, urgency and routine business processes — not simply because staff were careless.

“The best protection is layered: phishing training, multi-factor authentication, least-privilege access, password managers, payment-change verification, fast reporting channels and clear incident response steps,” he said.

“A blame-first culture can make breaches worse because employees may delay reporting for fear of being punished.

“The most useful message to staff is: report quickly, even if you think you made a mistake. Speed can reduce the damage.”

Mr Hayden said it would be unlikely an employee would be dismissed over a cyber security breach, unless they acted recklessly or were involved in deliberate conduct.

“A dismissal is harder to defend where the breach was a genuine mistake and the employer had weak systems, unclear policies or poor training,” he said.

“Employers should investigate first, assess the seriousness of the conduct, consider the employee’s history, and follow a fair process before deciding on dismissal.

“Employees could face legal action in serious cases, but it is uncommon for employers to sue staff over an honest mistake.

“Legal risk is more realistic where the employee acted deliberately, stole data, misused confidential information, accessed systems without authorisation, or caused loss through reckless conduct.”