Overview
- ASOS disclosed in a London Stock Exchange filing that on October 6 an unauthorised party accessed basic customer contact data after impersonating a trusted contact to obtain an employee’s login credentials.
- ASOS says passwords and payment‑card details do not appear to have been taken and that the attacker used those credentials to reach information on third‑party platforms that were then locked down.
- The Foschini Group’s UK arm, TFG London, told customers it identified a cybersecurity incident on October 11 affecting Phase Eight, Hobbs and Whistles, has notified the ICO, and sees no current reason to believe payment data were exposed.
- Snowflake has said its service was not responsible for the ASOS intrusion, while retailers have engaged external cyber teams and law enforcement to investigate supplier access and containment.
- Security experts warn that even limited contact‑data exposure raises a high risk of targeted phishing and extortion, and they say the cluster of incidents underscores the need for retailers to isolate supplier access and boost defences before the holiday trading period.