This Week's Cyber Radar

1. Impersonation behind the ASOS customer breach

ASOS customers received unauthorised push notifications on 6 October after someone impersonated a trusted contact to obtain an employee's login. That login was then used to reach third-party platforms, exposing three types of information: full names, contact details and some account-related data. However, ASOS says card details and passwords were not accessed, and it has not yet given a figure for how many customers are affected.

2. Legacy sign-on exposes school software supplier

Education software supplier Bromcom told customers that an unauthorised party retrieved email addresses and related sign-in details from an old single sign-on registration feature. The feature had been replaced but stayed in production because an internal system still called it, and the company's software is used by more than 5,000 schools. Notably, Bromcom says its main school records system showed no sign of compromise, and its investigation with external specialists is continuing.

3. Supreme Court weighs data claims threshold

A UK Supreme Court appeal listed for 7 and 8 October will decide whether people claiming damages under data protection law must first meet a seriousness threshold. The case was brought by more than 400 Sussex Police officers whose pension statements were sent to old addresses by their pension administrator. Therefore, the ruling could shape how many low-harm claims organisations face, at a time when complaints to the regulator have risen from 42,300 to over 76,700 in a year.

4. Joint advisory names Chinese security supplier

The NCSC joined agencies in the US, Australia, Canada, New Zealand, Japan and Spain in naming Integrity Technology Group, a sanctioned China-based software supplier, as enabling state-backed hackers. A botnet linked to the company in 2024 reportedly included about 250,000 hijacked devices, roughly 8,500 of them in the UK. Notably, the methods in the advisory lean largely on older flaws, so basic patching, multifactor authentication and switching off unused services remain the practical answer.

5. Atlassian flaw exploited within hours

Atlassian disclosed on 5 October a flaw affecting eight self-hosted products, including Jira, Confluence and Bitbucket, that can be exploited without logging in. A security firm saw exploitation attempts within two hours of a public technical report and exploit code, and expects activity to rise over the coming weeks. In short, organisations running their own copies should apply Atlassian's updates or limit external access straight away, because Atlassian cannot tell whether individual instances have been compromised.

Ordinary access, not exotic attacks, shaped the week.

If you would like to talk through what these stories mean for your organisation, our team is happy to help.