One hacked app, thousands of customers – could your business be next?

ASOS hackers expose the hidden cyber threat to small businesses

A message from hackers appearing inside the official ASOS app has exposed a frightening weakness in modern business security. Companies can spend fortunes protecting their own systems, only to discover that an outside supplier has provided the attackers with another way in. For Britain's small and micro businesses, which depend increasingly on third-party digital services, the warning is clear: your business could be exposed through a company you thought you could trust.

ASOS HACK SHOWS JUST HOW EXPOSED SMALL BUSINESSES ARE

Retailers got a warning shot across the bows this week when ASOS customers found a push notification saying the company had been hacked. Hackers used the retailer’s own push‑notification system to send ransom threats directly to customers’ phones. The message came through ASOS’s own official app.

The hackers claimed they had “fully compromised” data and threatened to leak customer information unless ASOS engaged with them. Basic personal data such as names and contact details may have been got at, though ASOS says payment-card details and passwords weren’t affected.

Photographer: Markus Spiske Unsplash photo ID: Skf7HxARcoc

The Big Lesson

The ASOS breach highlights a growing problem: our cyber security is only as strong as the platforms we plug into. ASOS’s issue came from third‑party customer‑communication platforms, not its core retail systems.

Small businesses often rely on:

• cloud storage

• CRM systems

• email marketing tools

• payment processors

• fulfilment partners

• analytics platforms.

Every one of these connections grows the possibility of a cyber-attack. Our cyber security is increasingly only as strong as the organisations we connect to.

Trust

What made the ASOS incident different was visibility. Hackers used the retailer’s own push‑notification system to send ransom threats directly to customers’ phones.

For small businesses, this is a nightmare scenario because customers lose trust instantly and social media erupts with chatter and speculation. Sales drop as a result and the reputation that you’ve taken years to build is lost in seconds and that lasts for ….. how long is anyone’s guess. Trust is fragile and once it’s gone, at best it’s expensive to rebuild and at worst it takes the business down with it.

Getting Smarter

Cyber specialists say attackers are now using AI at a speed the people trying to build the defences can’t match. Weak authentication is a major problem, and many businesses still rely on outdated password systems.

For small firms, this means attacks are more automated, vulnerabilities are easier to exploit, and recovery is harder without proper backups. No business is too small for the hackers to attack.

Vulnerability

Many businesses think they’re safe because they’re “fully patched,” but experts warn that patching is meaningless without robust backups. If you can’t roll back quickly, you can’t recover quickly and downtime caused by any disaster kills small businesses. Trust goes and customers go elsewhere.

This is where micro businesses struggle most because most don’t have dedicated IT teams or formal backup routines. Supplier‑security checks often depend on assurances from the suppliers themselves and there’s no process to make sure every user proves their identity with two or more checks before they can log in.

Wake-Up Call

The ASOS hack is a warning to:

Lock down admin access with multi factor authentication for every admin account email, CRM, payments, cloud storage.

Map your suppliers. List every platform that holds customer or employee data. Ask each one how they show you their cyber assurance (Cyber Essentials is a good baseline. Go to the National Cyber Security Centre’s official Cyber Essentials website, which provides full guidance, free tools, readiness checkers, assessment questions, and links to certified advisors. Cyber Essentials | National Cyber Security Centre

Build a real backup routine: daily backups, tested monthly. Store at least one offline. This will make the difference between a bad day and a business‑ending event.

Prepare for customer communication failures. ASOS showed how attackers can hijack trusted channels and leave a trail of chaos. Make an inventory every system that can message customers and tighten access controls.

On the Frontline

The ASOS hack proved that attackers wheedle their way in through trusted communication channels. Supply‑chain security is the new frontline. Small businesses are just as exposed as big retailers and resilience matters more than perfection.

Small and micro businesses don’t need enterprise‑grade cyber security, but we do need robust basics, secure suppliers, and a backup plan that works if and when we need it.