The Message That Looked Trusted
ABRI Systems ·
ASOS told customers this week that an attacker had obtained an employee’s login by impersonating a trusted contact. That login was then used to reach information in third-party platforms. The retailer said names and contact details were affected; it said passwords and payment-card information were not.
There was no cinematic “hack” required. The attacker needed a message that felt ordinary enough for a real person to trust it.
What social engineering means
Social engineering is when an attacker targets a person’s trust rather than a technical flaw. They may pose as a colleague, supplier or support person and create enough urgency or familiarity to obtain a password, verification code or sign-in approval.
Once an attacker has a real employee login, their activity can resemble normal work. That is why an account that reaches outside services needs more protection than a password alone.
The meaningful lesson: protect the decision point
The real security boundary was the moment an employee was asked to prove who they were or approve a sign-in. A request arriving by email, chat or phone is not trustworthy simply because it looks familiar.
Phishing-resistant multi-factor authentication makes a stolen password much less useful. Organizations should also map what each employee account can access in connected third-party tools, so one account does not quietly become a master key.
One security tip
When someone asks for a password, code or urgent sign-in approval, verify using a contact method you already trust. Do not reply to the message or use the phone number it provides. Start a new call, chat or ticket through the organization’s known directory.
References
Reuters, October 8, 2026 — UK’s ASOS says cyber hack accessed customers’ personal data.