Madrid, 14 October 2026. Internet Security Auditors encourages organisations to assess social engineering risks, corporate access and third-party platforms together. Protecting data requires coordination between people, procedures and technical controls.
ASOS confirms that an attacker impersonated a trusted contact to obtain an employee’s credentials and access information on external platforms. Its investigation identified access to names and contact details, among other account-related data. The company states that customer passwords and payment card information were not accessed. [1]
Controls to check. Verify sensitive requests through an independent channel; strengthen multifactor authentication, prioritising methods resistant to credential capture on fake websites; limit permissions; and review supplier accounts and integrations. A simple reporting channel and procedures to disable accounts and revoke sessions support a rapid response. [2, 3]
Internet Security Auditors general services. Authorised social engineering assessments, technical audits, penetration testing and risk consulting help evaluate controls and define improvements. Tailored training and response exercises reinforce their practical application. Deliverables can include evidence, an executive summary and an action plan with assigned owners; follow-up verification checks remediation. [4, 5, 6]
Referencias
[1] ASOS — Información oficial sobre el incidente (consulta: 14/10/2026)
[2] NCSC — Reconocimiento y comunicación de intentos de suplantación
[3] CISA — Autenticación multifactor resistente al robo de credenciales mediante engaño
[4] Internet Security Auditors — Pruebas de ingeniería social
[5] Internet Security Auditors — Pruebas de intrusión
[6] Internet Security Auditors — Consultoría en seguridad
