…said every spokesperson following an incident. It is no surprise that this is a recurring theme across the various customer facing hacks around the world; the 2025-26 attacks against Co-op, Harrods and ASOS themselves are examples of this. While card numbers and plaintext passwords are the crown jewels that attackers aim for, arguably even the non-sensitive information can still be weaponises just as effectively.
The October 2026 attack against the Snowflake instance on ASOS’ estate demonstrates this. The data exposed details a list of real customers for attackers to target, and use of a legitimate communications channel can quickly abuse the customers’ implicit trust of application notifications. With a little coercion this attack path would pave the way for additional compromises against individuals themselves.
With Harrods and Co-op, customer contact details and business information were similarly leaked. This means more real individuals to target against at a future date. Attackers can rinse and repeat attacks against multiple organisations and start to build a bigger profile based on the aggregate information collated across different datasets. This can be further supported by the ease in buying legitimate customer information from data brokers in this day and age.
Suddenly the attacker now has a more complete profile of a set of customers- basic contact details from retailer A, phone numbers from provider B, their employment details from LinkedIn, purchasing habits from C/D etc. From this they can infer the following:
- If they have disposable income based on spending habits, frequency, where they shop, and the order amount
- If they have any medical conditions which would make them a vulnerable target based on whether they buy any medical equipment
- If they are working for any big name employer, which would allow them to start targeting those organisations in a separate attack campaign.
- Particularly, if people use their company emails to buy dubious goods and services, they can also be targeted for extortion (as in the Ashley Madison hacks in 2015).
Even if no further attacks were to be conducted and no ransom has been paid, an attacker may also sell on the customer data for a profit to other clients or attackers who may make better use of this information.
The takeaway from this is not a set of action points to enact on – there are plenty of articles online that discuss what to do in the event of a breach. The more important point is for company directors to continue to appreciate the security controls that are in place around customer data and to not judge the severity of a breach on whether highly sensitive information was exposed. As the saying goes – give attackers an inch, and they will take the entire database.
How Prism Infosec can help
Are you a director of a company? Have you thought about how safe your digital estate is and the potential impact of a given security breach? If you would like a professional second opinion, please get in touch with our team at Prism Infosec.
