Business

Follow-up: Asos says cyber attack cut October sales by up to 4%

Asos FY26 results put the October cyber attack’s cost at 2-4% of that month’s sales, roughly £4m-£8m. What UK firms should learn.

Chart motif illustrating the financial cost of the Asos cyber attack in its annual results

Asos has put a number on the October intrusion for the first time: an estimated 2-4% off that month’s gross merchandise value, which is roughly £4m to £8m of lost sales at its usual monthly run rate. The retailer says the hit was temporary, but the episode shows how one stolen login turns into a line in the annual results.

What happened

On 5 November 2026 Asos published its final results for the 52 weeks to 30 August 2026, and they included the first quantified assessment of the cyber incident it disclosed on 6 October. The online fashion retailer estimates the attack, and the precautions it took in response, reduced October gross merchandise value (GMV) by between 2% and 4%. UK trading suffered most.

Asos turns over about £200m of GMV a month, so that range works out at around £4m to £8m in lost sales. That figure comes from press calculations, City AM’s among them, based on the company’s percentage. Chief executive José Antonio Ramos said the effect had dissipated so far in November, and Asos told investors that sales since the year end had been broadly flat. On that basis the company called the damage temporary.

This site covered the original incident on 10 October, when it became clear the breach was wider than first disclosed after a member of staff had their login stolen. The results add little technical detail, but they do supply the financial cost and an explanation of where it came from.

The rest of the results tell a recovery story. Asos reported pre-tax profit of £24.4m against a loss of about £282m a year earlier, and its underlying EBITDA was £170.3m. Like-for-like GMV fell 5% over the year, but it grew in the fourth quarter for the first time in four years. Guidance for the year to August 2027 is £180m to £200m of underlying core profit. Shares rose about 6% in early trading, and IG analyst Chris Beauchamp suggested “the long nightmare for ASOS” might be over.

The detail

A quick recap of the incident. According to Asos, the attacker posed as a trusted contact and persuaded an employee to hand over login credentials. Those credentials were then used to reach information held on third-party platforms the retailer relies on, not its core e-commerce systems. In its 6 October stock exchange update, Asos said an unauthorised notification had been sent to customers through those communication platforms. The data exposed was basic personal information, chiefly names and contact details. Asos maintains that payment card data and account passwords were not affected.

The way the cost arose matters more than the number itself. The website and app stayed up throughout. According to Asos, the sales dip came mainly from its own containment measures: it paused some marketing and customer relationship activity for up to two days while it added security controls. In effect, a retailer that relies on email and app pushes switched off its own demand engine because it could not be sure those channels were safe.

The market reaction was harsher than the eventual cost. City AM reports that Asos shares fell around 12% in October after a previously unknown group claimed it had breached the company and taken customer details. On 6 October Asos had called the trading impact “currently unquantifiable”; a month on, it amounted to roughly a day’s worth of sales.

Timeline of the Asos cyber incident from disclosure on 6 October to the 5 November results quantifying the sales hit

Why it matters for UK organisations

Asos is the second large UK retailer in two days to report results that still carry the marks of a cyber incident. On 4 November Marks & Spencer reported a sharp rebound in half-year profit, but it said its fashion, home and beauty business was still dealing with stock availability problems that dated back to its own attack. Together the two give boards a range of outcomes, from about a day of lost sales to disruption that spans reporting periods.

The figures also show which costs tend to appear in public accounts. Asos’s disclosure covers lost sales. It does not break out incident response fees, legal advice, customer notification or any regulatory follow-up, and those costs usually arrive later and less visibly. Anyone building a business case from a headline figure like this one should treat it as a minimum.

The entry point is also familiar: social engineering aimed at a person rather than a software flaw, leading to SaaS tools that sit outside the main security perimeter. Third-party marketing, messaging and CRM platforms usually hold exactly the contact data that makes a follow-on phishing campaign convincing.

Expert view

In my experience, the most expensive part of a contained incident is often the decision to stop doing business while you work out what is safe. Asos appears to have made that call quickly and kept it short, which is the right instinct. Two days of paused campaigns cost far less than letting an attacker keep using a channel your customers trust.

The weak point is where this attacker went. When we test retail and consumer brands, the marketing stack is often the least governed part of the estate. Accounts are created by agencies or individual teams, single sign-on is applied unevenly, and logging is whatever the vendor offers by default. Because these platforms can message the entire customer base, a compromised login carries far more risk than its place on the org chart suggests.

I would be cautious about treating the chief executive’s remark that it was not “such a big thing” as a general lesson. Asos got off relatively lightly because payment data and passwords stayed out of reach and its core platform kept running. If any of those had gone the other way, the 2-4% range would have looked very different.

What to do now

  1. Map who can message your customers. List every platform that can send email, SMS or push notifications at scale, who holds admin access, and whether that access goes through your identity provider. This sits under the Cyber Essentials user access control requirement.
  2. Put phishing-resistant MFA on high-reach SaaS. Prioritise FIDO2 or passkeys for marketing, CRM and messaging admins, and remove shared or agency-held accounts that bypass single sign-on.
  3. Harden identity verification at the help desk and among staff. Make it routine to call back on a known number before acting on a request that claims to come from a colleague or supplier, especially one involving credentials.
  4. Pre-agree a “pause” playbook. Decide in advance who can suspend campaigns and outbound messaging, how quickly, and how customers will be told. The aim is to make containment decisions in hours rather than days.
  5. Measure the cost properly. Make sure finance can isolate daily trading impact during an incident, and confirm SaaS vendors keep audit logs you can export quickly.

Bottom line

Asos has shown that a contained social engineering breach can be absorbed: a few million pounds of lost sales, a short pause in marketing, and a profitable year regardless. That outcome came from a quick containment decision and a little luck about what the attacker could reach. UK organisations should treat the second part as something to engineer, not hope for, by locking down the platforms that speak to their customers.

Sources

Related Posts