Cyber incidents are becoming harder to categorise as purely technical events. The consequences can quickly spread into customer trust, operational resilience, financial performance and reputation. This is why cyber risk is increasingly becoming a board-level concern, not simply an IT issue.
The recent ASOS cyber incident is a useful example.
In October 2026, ASOS confirmed that an attacker had impersonated a trusted contact to obtain an employee's login credentials. Those credentials were then used to access customer information held on third-party platforms. ASOS said payment card details and account passwords were not compromised, but some customer personal information was accessed.
The significance of the incident goes beyond the breach itself. It reflects several issues that are becoming more important for large organisations: social engineering, third-party technology, customer data and the wider financial and reputational impact of a cyber event.
Cyber risk has moved beyond the IT department
For years, cyber security was often treated as a specialist technology issue.
The IT team secured the network, controlled access and dealt with technical incidents when they arose.
Technology now sits across almost every part of a modern organisation. Finance teams rely on cloud-based accounting systems. Sales teams work through CRM platforms. HR data may sit with specialist software providers. Customer service teams depend on external communication platforms.
As those dependencies grow, so does the potential impact of a cyber incident.
A breach affecting one employee account can quickly become a data, operational or reputational issue. The result is that cyber risk increasingly overlaps with the same areas boards already monitor, including business continuity, supplier risk, regulatory exposure and financial resilience.
For boards, the focus is whether the organisation understands its exposure, dependencies and ability to respond—and how much risk it is prepared to carry.
The ASOS incident shows how cyber exposure is changing
One of the most notable aspects of the ASOS incident is that the initial point of compromise was reportedly not an advanced technical exploit.
ASOS said the attacker impersonated a trusted contact and obtained an employee’s login credentials. Those credentials were then used to access third-party platforms holding customer information.
That sequence highlights how human risk and third-party technology are increasingly connected.
A single compromised account may provide access to systems that sit outside the company's own infrastructure. That means the traditional idea of a clearly defined cyber perimeter is becoming less useful.
The wider issue is not simply whether internal systems are secure. It is how people, platforms and suppliers connect with one another, and how quickly a weakness in one area can create exposure elsewhere.
Gareth Roberts, Client Adviser at Macbeth Insurance Brokers, highlighted the ASOS incident as an example of how quickly a cybersecurity issue can develop into a wider financial and reputational problem.
He said: “A cyber incident does not have to stop a business trading to cause financial and reputational damage. Strong security, a tested response plan and suitable cyber insurance can help businesses access specialist support and manage insured costs when every hour matters.”
Third-party platforms are reshaping the risk perimeter
The use of external technology is not itself the problem.
Cloud infrastructure, SaaS platforms and specialist suppliers allow organisations to scale quickly and access technology they would struggle to build themselves.
But every dependency changes the organisation's risk profile.
Customer data may sit with one provider, payments with another and communications with a third. Different employees may have access to each platform, often through separate accounts and credentials.
That creates a more complex risk environment.
The relevant exposure is no longer simply whether an internal server can be compromised. It may be whether an external platform can be accessed using valid credentials, whether a critical supplier becomes unavailable or whether sensitive data held elsewhere can be exposed.
For large organisations, cyber risk is therefore increasingly intertwined with third-party and operational risk.
A company can stay online and still suffer serious damage
Another notable feature of the ASOS incident is that its main website and app remained operational.
The business still had to secure affected platforms, investigate the breach, involve cyber specialists and communicate with customers and other stakeholders.
That challenges the idea that the severity of a cyber incident should be judged mainly by whether the organisation stops trading.
Operational downtime is only one measure of impact.
A cyber incident may also lead to:
forensic and investigation costs
legal and regulatory exposure
customer communications and crisis management
reputational and financial consequences
These are potential consequences of cyber incidents generally, rather than confirmed losses or regulatory breaches arising from the ASOS incident. Such costs can develop even when core systems remain available.
That makes cyber incidents harder to assess using traditional business continuity measures alone.
Data breaches can create a second wave of risk
The immediate breach is not always the end of the incident.
Where customer information is exposed, there is a risk that it can later be used to make phishing emails, telephone calls or impersonation attempts more convincing.
The more information criminals hold about an individual, the easier it can be to create communications that appear legitimate.
That creates a second layer of exposure.
For organisations, the impact of a breach therefore goes beyond the technical question of what data was accessed. It also affects customer trust, communications and the potential for follow-on fraud.
This is another reason cyber incidents increasingly resemble evolving business events rather than single moments of system failure.
Why cyber risk is moving higher up the corporate agenda
Cyber risk increasingly overlaps with areas directors already oversee.
A significant incident can affect:
financial resilience
operational continuity
customer confidence
corporate reputation
It can also create regulatory and supplier-related consequences.
That is why the conversation at board level is changing.
The focus is becoming less about specific security tools and more about whether the organisation understands its exposure, dependencies and ability to respond.
This is particularly important as businesses become more digitally interconnected.
The same technology that supports efficiency and growth can also create dependencies on systems and suppliers the organisation does not fully control.
Cyber governance is therefore increasingly about understanding those relationships and deciding how much risk the business is prepared to carry.
Cyber insurance is becoming part of the resilience discussion
This changing environment also affects the role of cyber insurance. Cyber insurance cannot prevent an attack and should not replace strong security or governance.
Its role is to help organisations manage some of the financial consequences of an insured event and, depending on the policy, access specialist support during the response.
That may include areas such as forensic investigation, legal support, data breach response, business interruption and crisis management.
Coverage varies by policy and is subject to exclusions, limits, deductibles and applicable conditions.
The wider point is that cyber insurance increasingly sits within a broader resilience strategy rather than operating as a standalone financial product.
As organisations become more dependent on cloud platforms, third-party services and interconnected systems, their risk profile can change quickly. Their approach to risk transfer needs to change with it.
The boundary between cyber risk and business risk is disappearing
The ASOS incident will not be the last cyber event to begin with a relatively narrow security issue and develop into something much wider.
A compromised employee account can expose customer information. A third-party platform can become part of an incident even while a company's own systems remain available. Stolen data can create further risks after the initial breach has been contained.
These issues are no longer confined to the IT department. They affect finance, operations, legal, customer service, communications and senior management.
For boards, investors and risk professionals, that is the wider lesson. Cyber risk is becoming harder to separate from enterprise risk because the consequences are increasingly interconnected, harder to contain and more relevant to the financial resilience of the organisation as a whole.