The recent ASOS cyber attack is a reminder that protecting an organisation involves more than installing the right security software. It also means understanding who has access to your systems, how people prove who they are, and what happens when someone’s identity is compromised.
For business leaders, there are practical lessons here. You don’t need to wait for an incident to review your approach to employee identity management and access security. In this review, I will provide three places any organisation can start.
On 6 October 2026, some ASOS customers received an unauthorised push notification through the retailer’s app. The message appeared to come from ASOS but contained a claim that the company had been hacked and directed people towards an external link.
ASOS subsequently confirmed that an unauthorised person had impersonated a trusted contact to obtain an employee’s login credentials. Those credentials were then used to access information held on certain third-party platforms used by ASOS.
The company said that some customer personal information, including names and contact details, had been accessed. ASOS also said payment-card data had not been accessed, and it restricted access to the affected platforms while investigating the incident with specialist advisers and relevant authorities. The investigation is continuing.
The important lesson is not that every organisation faces exactly the same threat. It is that trust can be exploited, and access to one account can create a route to information elsewhere.
So, what can businesses learn from the ASOS cyber attack?
Start with a straightforward question: do you know who can access your organisation’s systems and information today?
Imagine an employee, let's call her, Jane Smith has worked for your organisation for ten years. She uses internal systems to view her payslips, book holiday, communicate with staff, check her shifts and contact the help desk. Her access is legitimate because she is a trusted employee.
But what happens if someone pretends to be Jane? And how confident are you that the systems she can access are appropriate for her role?
These questions matter because most people end up with more access than they need. People change roles, move between departments or leave the business, while accounts and permissions may not always be updated as promptly as they should be. External providers and contractors can also retain access if nobody clearly owns the process of reviewing it.
Three practical actions to take:
Access management is an ongoing process that should reflect how your organisation and its people change. Check access every time someone joins, moves or leaves, and don’t wait for the auditors to ask.
The ASOS incident highlights how an attacker can exploit trust to obtain someone’s credentials. This is why security cannot rely on employees simply recognising suspicious messages or remembering not to share passwords.
People are busy. They receive requests from colleagues, managers, suppliers and service providers every day. A convincing message that appears to come from someone they know can be difficult to distinguish from a genuine request, particularly when it creates a sense of urgency.
Organisations need controls that help protect people even when an attempt at impersonation gets past their attention.
Three practical actions to take:
These measures work best together. Authentication controls can make it harder for stolen credentials to be used, while clear verification and reporting processes help an organisation respond when something does not look right.
Many organisations have well-established processes for employees who work at a desk, have a corporate email address and use a company laptop. But those assumptions do not always fit a frontline or extended workforce.
Think about employees working in retail, manufacturing or warehouses. They may need to access their payslips, check shift rosters, read company communications or contact the help desk, without having a corporate email address or a dedicated work computer.
They still need reliable, secure access to the information and services that help them do their jobs. If the organisation’s approach to identity management does not account for their needs, it can create unnecessary complexity for employees and the teams supporting them.
Effective employee identity and access management means understanding who your employees are, which systems they need to access, how their identity is authenticated and how you ensure their access remains appropriate throughout their time with your organisation.
It is not simply a technology choice or a box to tick. The process has to work for the people who use it, while giving the organisation the controls it needs.
Three practical actions to take:
Design around the way people work. Make sure frontline employees can securely access the services they need without relying on office-based assumptions that do not fit their roles.
Reduce unnecessary credential complexity. Consider whether employees really need a separate corporate email address or traditional username and password for every service. Purpose-built approaches can reduce the number of credentials employees have to manage, while maintaining appropriate authentication and access controls. And the fewer credentials people have, the fewer an attacker can talk them out of.
Include the extended workforce. Contractors, outsourced help desk teams and external service providers may also need access to your systems or information. Understand who they are, what they need to access and when that access should end.
At Connect Frontline, we believe frontline identity management should be treated as a core security capability, not simply an employee-experience challenge. Our platform enables organisations to establish and manage a trusted digital identity for every frontline worker, including employees who do not have a corporate email address.
By reducing reliance on traditional credentials, organisations gain greater control over who can access systems, services and communications. Access can be provisioned consistently, monitored centrally and, when necessary, revoked immediately.
In the event of a suspected compromise, organisations can rapidly disable an employee's access through a centralised kill-switch capability, helping contain risk while investigations take place. This level of visibility and control is particularly important in large frontline environments where thousands of employees, contractors and third parties may require access to business systems.
For organisations with large frontline workforces, identity is often the first line of defence. The ability to verify, manage and rapidly control access at scale can significantly reduce both operational and security risk.
Security is an organisational responsibility, but employees can play an important part. Clear, simple guidance is more useful than expecting everyone to become a cyber security expert.
Three habits are worth reinforcing:
The ASOS cyber attack is a useful reminder that cyber security is about more than protecting technology. It is also about the identities people use, the access those identities provide and the trust organisations place in everyday interactions.
For business leaders, the starting point is to understand who can access your systems, make impersonation harder and ensure your identity management approach works for your entire workforce, including frontline employees and the extended workforce.
For many organisations, particularly those with large frontline workforces, the challenge is not simply knowing who has access today, but being confident they can immediately remove that access tomorrow if an identity is compromised.
It is worth asking yourself three questions:
You do not need to wait for a cyber incident to find out where the gaps are. Reviewing these areas now can help protect your employees, customers, information and the trust your organisation depends on.