03 November 2026

Don't Be the Next ASOS

UK retailers of every size are being targeted.

The headlines go to the big names. Earlier this month ASOS became the latest major UK retailer to confirm a data breach, following the attacks on M&S and the Co-op in 2025. Retailers of every size are being targeted, though, and attacks on smaller stores rarely make the news.

ASOS customers found out about their breach from the attackers. The message arrived as a push notification inside the ASOS app, before most people had heard anything from the retailer itself.

What happened at ASOS was not a checkout attack, and your setup will look very different. The question it raises still applies to every online store. If someone got into your checkout tomorrow, who would notice first?

What happened in the ASOS data breach?

On 6 October, ASOS app users received a notification from a group calling itself Xuanye Group. It claimed the group had stolen customer data and told ASOS staff to get in touch, or the data would be leaked.

ASOS confirmed the breach shortly afterwards. According to BleepingComputer, someone impersonated a trusted contact to get an employee's login details. Those details were then used to reach customer information held on third-party platforms ASOS uses.

ASOS says names, contact details and some account-related information were taken. It says payment card details and passwords were not accessed. The investigation is ongoing, so the full picture may still change.

The detail that made headlines was the order of events. Customers saw the attackers' message on their phones before they had read anything from ASOS, as TechCrunch reported.

Are smaller retailers being targeted?

Yes. The big brands make the news, but attacks on retail are far more widespread than the headlines suggest.

31% of UK retail and wholesale businesses identified a cyber breach or attack in the past 12 months, according to the UK Government's Cyber Security Breaches Survey 2025/2026.
48% of breaches analysed in Verizon's 2026 Data Breach Investigations Report involved a third party, up from 30% the year before.
More than 10,500 card-skimming infections were active on online stores at some point during 2025, according to Recorded Future.

Recorded Future also found that 26% of those infections traced back to a single skimming kit. One tool, reused across thousands of stores, is a good reason to stop thinking of your site as too small to be worth attacking.

Why is checkout skimming so hard to spot?

The ASOS attackers wanted to be seen, because they were applying pressure. Attackers who target checkout pages want the opposite. A skimming attack only pays while it stays hidden, so it is built to change nothing your customers or your team would notice.

In a typical attack, a few lines of malicious JavaScript end up on your checkout page. Sometimes that happens through one of your own files, but often it arrives inside a third-party script you already trust, such as analytics, a chat widget or a marketing tag.

The script copies what customers type into the payment form and quietly sends it to a server the attacker controls. The order still completes, the payment still goes through and the confirmation email still arrives. From the customer's side, and from yours, it looks like a normal sale.

Some skimmers go further to avoid detection. They may only run on checkout URLs, only for certain visitors, or only at certain times of day. A developer who opens the page to check it may see nothing unusual at all.

How do retailers find out about a skimming attack?

Because nothing visibly breaks, the warning usually comes from outside the business. By the time it reaches you, the script has normally been running for a while.

The most common routes in are:

Your customers. People notice fraudulent transactions on their cards and contact you to ask whether your site is safe.
Your payment provider or acquirer. Card issuers look for patterns of fraud across cards, and a cluster that traces back to the same retailer can lead to a call from your provider.
Security researchers. Independent researchers scan the web for known skimming code and sometimes find it on a retailer's site before the retailer does.

All three share one problem. Each one starts after customers' card details have already been taken, which means every day a skimmer runs adds to the number of people affected.

That brings it back to the ASOS question. Hearing about an attack from someone else is a sign that nobody inside the business was watching that part of the site.

How do I know what is running on my checkout page?

Start by asking a few questions of your own team, agency or platform provider. If the answers are vague, that tells you something too.

Do you have a current list of every script that loads on your checkout and payment pages? Include anything added through a tag manager, not only what is in the site code.
Who can add or change those scripts? Think about marketing logins, agency access and any third-party tools with permission to publish tags.
Would you know if one of those scripts changed? Third-party scripts are hosted by their supplier, so they can change without anyone on your side deploying anything.
When did someone last check whether each script needs to be on checkout? Tags added for a campaign two years ago often stay long after anyone remembers why.
Is anything on those pages being checked between developer reviews?

The last question is the one most retailers struggle with. A one-off review shows you what was on the page on the day it happened. Skimming code can be added the following week and sit there unnoticed until the next review, or until a customer calls.