From ASOS to M&S, recent data breaches started with a simple, unintentional human error rather than a complex technical failure. As cyberattacks get increasingly common and sophisticated, training alone won't stop social engineering.
Over the last two years, cyber attackers have sauntered into the online spaces of multiple high-profile retailers, shutting down business, losing them millions of pounds of profit, and even sending out threats to their customers.
Not all of this is actually about the tech. We all know not to click on suspicious links or share passwords, but breaches keep happening because in the moment, other priorities – like helping a colleague or meeting a deadline – take precedence, and modern attackers know to exploit these instincts.
Cyberattacks are getting increasingly common and increasingly sophisticated, but many successful breaches begin with a simple, unintentional human error rather than a complex technical failure. As companies rally to protect their businesses, people need to be at the forefront of their defence. This is about more than upskilling. Resilience lies in awareness, habits and behaviour.
An open door: social engineering at M&S, the Co-op and JLR
In 2025 a scammer impersonated an employee at M&S and asked for a password reset. The person on the service desk, which was operated by a third-party provider, was persuaded to help out and had no idea they’d done anything wrong. This gave the attackers access as easy as a door held open for them to waltz right in. The root of these enormous breaches are tiny: in the case of M&S, it was one person trusting one voice over the phone, asking for a password reset to meet an important deadline.
In the space of three months, the same group of attackers successfully targeted the Co-op and Harrods. In every case, the person dealing with the request was competent and trying to help in a stressful situation, with a persuasive person on the other end of the line. But the cost was mighty. Between M&S and the Co-op, the financial cost is estimated to have been between £270 million and £440 million.
Jaguar Land Rover reportedly faced similar social engineering techniques, where attackers manipulated human trust to get access to the company’s data.
Misplaced trust: the ASOS breach
In 2026, ASOS customers received a threatening app notification. The message said that their data had been compromised and ASOS should engage with the attackers or have their data leaked. Investigating the attack, ASOS reported that an unauthorised party had gained access to an ASOS employee account through very similar means to the M&S case, by impersonating a trusted contact to get login details, which were then used to access information on third-party platforms.
Stolen information included customer names, home addresses, email addresses and dates of birth. The impact was immediate. After the notification, ASOS shares fell by over 10%.
Why do data breaches keep happening?
Everyone’s done the cybersecurity training. We all know we should be vigilant when it comes to potential scams. But with the scammers getting smarter and targeting human fallibility, what matters is the culture around cybersecurity and how someone is taught to respond in a moment of uncertainty, whether that’s in response to something online or over the phone. The safety of personal data, money and business reputation can all lie in that split second to pause and check. Attackers succeed because they create pressure and urgency, causing people to override what they already know.
So what can we do to protect our businesses from cyberattacks?
Invest in people
An easy way for businesses to reduce the risk is to support people. While some companies might increase cyber training or upskilling in tech skills, the cases described above prove that it’s not always about the technology. Training might give the right information, but it doesn’t inherently lead to a change in behaviour, especially when the problem isn’t due to a capability gap. By approaching cybersecurity from a human angle, we acknowledge how easy it is for a hacker to worm their way into a system. Not every scam works in the same way, but for these high-profile cases, a quick check could have prevented these multi-million pound failings.
Better communication
Breaking down barriers between IT and other users can help to open up communication which then helps users to raise concerns, leading to safer decision making and a reduced likelihood of these scammers getting their way. Employees are often asked to contact third party helpdesks, which can be more challenging to build a trusting relationship with, where having friendly local reps who can answer queries can make ‘doing the right thing’ easier.
Help people act in the moment
Promote the small changes in behaviour that make a big difference. Most employees know they shouldn’t share passwords or click on suspicious links, but what matters is whether they pause and think in the moment when they’re distracted or under pressure and challenge an unusual request. A simple workplace prompt or nudge might be more effective than an entire training programme.
Leadership
Leaders have a crucial role to play. If speed and responsiveness are rewarded above all else, people will prioritise those behaviours. Leaders need to make it known that taking time to verify, challenge and check is part of good performance. This helps ensure that the workplace culture enables people to feel safe and confident enough to slow a process down and ask questions.
Make questions the default
When working at pace, it’s easy to fall into quick decision-making and taking the easy route. The key to good cybersecurity is ensuring that the default position is one of caution and asking questions.
Focus on behaviour rather than skills
Everyone knows the basic rules but the problem is what happens under pressure. Teaching cyber-behaviours rather than focusing on cyber-skills can help people act in the moments that matter.
Simple behaviours that make a difference to cyber risk
- Pause before acting on urgent requests
- Challenge unusual activity, even with trusted contacts
- Speak up when something doesn’t feel right
- Slow down when pressure builds
- Ask yourself: could this be a scam?
Your people are more important than ever. Helping them to stay vigilant is vital to the survival and strength of your business. Organisations that build these behaviours are more resilient than those that simply ask people to complete another training module. The future of cybersecurity is more human than you’d think.
See how we help organisations reduce risk by changing what people do, from cybersecurity to codes of conduct.