On 6 October 2026, ASOS customers received a push notification they were never meant to see. According to ASOS' subsequent investigation, hackers breached the company's third-party service provider’s systems and announced its attack publicly, through ASOS' own app.

Recent reports indicate that while names, contact details and personal search histories may have been accessed, no payment card information or account passwords appear to have been compromised. This wasn’t a conventional breach. Rather than operating quietly behind the scenes, the hackers exploited a direct line to ASOS' entire customer base to go public instantly. Fashion retail has emerged as a key target for threat actors, exposing brands to new and evolving legal and reputational risks.

Fast fashion: Pace and scale create vulnerability

Fast fashion platforms hold large volumes of customer personal data and process high numbers of daily transactions. A service culture that values speed can create real vulnerabilities, particularly to social engineering. The ASOS breach reportedly began not with a sophisticated technical exploit, but with someone impersonating a trusted contact to obtain an employee's login credentials. That’s a human problem as much as a technical one.

Fashion brands increasingly depend on multi-brand platforms such as ASOS, Farfetch or Selfridges to reach customers. While these arrangements provide significant commercial benefits, they also create dependencies. A cyberattack affecting a platform or supplier can disrupt sales, expose customer information and damage consumer confidence, even where the brand's own systems remain secure.

Who bears the risk when a multi-brand platform is breached?

There is currently no public indication that the recent ASOS incident compromised its partner brands' own systems or datasets. Nevertheless, it raises an important question: what happens when a platform holding customer information suffers a breach? The answer depends partly on the contractual relationship and the parties' responsibilities under data protection law.

A brand selling products through a platform will not automatically be responsible for a breach of that platform's customer data. Where both parties act as independent controllers, each is generally responsible for its own processing. However, where a platform processes personal data on behalf of a brand, the brand may retain regulatory obligations as controller, notwithstanding that the incident occurred within the platform's systems.

Under the UK GDPR, a controller must notify the Information Commission’s Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. A high-risk breach may also require notification to affected individuals.

Understanding these responsibilities before an incident occurs is essential. Brands need to know what customer information is shared, who controls its processing and what assistance they can expect if something goes wrong.

Cyber risk is also a contractual risk

Regulatory responsibility is only part of the picture. Even where a brand has no direct GDPR liability for a platform's incident, the commercial consequences may still be significant. Disrupted sales, customer complaints, reputational damage and the costs of responding to an incident can all affect the business.

This makes the contractual protections agreed with platforms and suppliers particularly important. For example, does the agreement require the platform to notify the brand promptly of a security incident affecting relevant customer data? Will it provide sufficient information to assess the impact and assist with customer or regulatory communications? Who bears the costs of incident response, and are cyber-related losses excluded or capped under the contract?

These questions are particularly relevant for smaller and mid-market brands, which may have limited bargaining power when agreeing to standard terms with major platforms. 

Smaller businesses also frequently share suppliers, marketing platforms, and logistics providers with other retailers, meaning a breach elsewhere in that ecosystem can expose them too. Cybercriminals routinely use high-profile breaches as cover for broader phishing campaigns impersonating multiple fashion brands at once. Customers with no connection to the hacked platform can still be targeted convincingly. App-first shoppers accustomed to frequent, personalised brand communications are precisely the audience that well-crafted phishing messages target. Familiarity with a brand's tone makes fraudulent imitation more convincing.

What should businesses do now?

The practical priorities are:

• Review and understand all supply chain third party contracts and controller and processor arrangements. Know where your customer data sits, who processes it, and what contractual rights exist to obtain incident notifications, investigation assistance and appropriate assurances over security. Consider how liability and incident-response costs are allocated.
• Update incident response plans to account for attacks on platforms used by the brand, and other critical suppliers (taking into account the contractual levers available to you), including how the business would obtain information, coordinate customer communications and assess regulatory reporting obligations.
• Strengthen access controls and monitoring. Review employee and supplier access to external platforms, implement appropriate multifactor authentication and monitor for unusual activity. Businesses should be equipped to detect and contain attacks involving compromised legitimate accounts.
• Treat customer communication channels as security-sensitive infrastructure, not simply marketing tools. Unauthorised access can enable attackers to impersonate a trusted brand and reach customers directly.
• Review cyber insurance to ensure cover extends explicitly to third-party and customer-facing platform incidents.

The ASOS attack is a clear indication of travel. Since 6 October, separate reports have followed of additional cyberattacks on TFG London, the UK arm of The Foschini Group, which owns Hobbs, Whistles, and Phase Eight. H&M is also currently investigating separate claims of another cyberattack.

Retail fashion sits at the intersection of high data volumes, complex supplier ecosystems, and consumer relationships built on trust. Across every part of the market, the legal and reputational exposure is real — and in many cases it hasn’t been adequately mapped or prepared for. If this article raises questions about your business's position, we would be glad to discuss them.

Contact Browne Jacobson's data, privacy and cybersecurity team for advice on data protection, third-party risk, and cyber incident response.