I felt bad when ASOS got hacked last week. Considering the turnaround they are building towards and them to be hit with a consumer trust challenge like this must have been, well, shit. So to put it frame where they were I thought it seemed like a good time to revisit the business I wrote about in April. Back then, healthier inventory, improving margins and early signs of customer growth suggested that three years of repair work were beginning to produce something worth watching. The breach raises a question: how much could a loss of customer confidence interrupt that progress?
This was less than 7 days ago. Since then the news kept arriving.
Shein reported UK revenue of £2.58 billion for 2025, up 26%, and pretax profits of £45.2 million, up 18%. Its reported UK revenue alone exceeded ASOS’s entire global revenue for its financial year ended August 2025. Different reporting periods and business models, certainly, but quite the reminder that competitors keep moving while you’re fixing the plumbing.Shein’s results and a customer data breach put the next stage of the recovery under pressure.
I felt bad when ASOS got hacked last week. Considering the turnaround they are building towards and them to be hit with a consumer trust challenge like this must have been, well, shit. So to put it frame where they were I thought it seemed like a good time to revisit the business I wrote about in April. Back then, healthier inventory, improving margins and early signs of customer growth suggested that three years of repair work were beginning to produce something worth watching. The breach raises a question: how much could a loss of customer confidence interrupt that progress?
This was less than 7 days ago. Since then the news kept arriving.
Shein reported UK revenue of £2.58 billion for 2025, up 26%, and pretax profits of £45.2 million, up 18%. Its reported UK revenue alone exceeded ASOS’s entire global revenue for its financial year ended August 2025. Different reporting periods and business models, certainly, but quite the reminder that competitors keep moving while you’re fixing the plumbing.
Meanwhile, ASOS acquired company on the cyber incident list. TFG London discovered an incident on 11 October affecting Hobbs, Whistles and Phase Eight, subsequently pausing online orders while stores remained open. Ahold Delhaize disclosed a network security issue on 12 October, taking systems offline, with disruption reported at Albert Heijn and other brands across its international operations.
In France, attackers went after the fridges. F*ckin fridges. Overnight on 11–12 October, refrigeration systems at hundreds of supermarkets were manipulated into defrosting, forcing affected stores to discard fresh and frozen food. Intermarché, Netto, Coopérative U, Carrefour, E.Leclerc and Monoprix were among the chains reported affected. Buildings went on fire, stock lost, data integrity now in questions.
Four major reported incidents, including ASOS, within a week. Separate events, with investigations continuing and no basis for treating them as one coordinated campaign.
For ASOS, the commercial fallout remains uncertain. But between a rival posting substantial UK growth and a breach touching the customer relationship it has been rebuilding, there is plenty to revisit.
So, how far has ASOS actually come and what does it still need to do?
Eight consecutive quarters of gross margin improvement. Healthier inventory. Better profit per order. Positive new customer growth in March for the first time since September 2021. A loyalty programme reaching approximately 3.5 million members.There was enough evidence to give the repair work credit. There was also enough unfinished business to keep the champagne in the fridge. In their favour, I was just with the IMRG in London and they were showing the numbers for fashion and its contraction as a category over the last 2 years. Stabilisation is occurring against most odds. Smart hiring too.
Two developments now make that distinction more important: Shein’s UK results and the breach at ASOS. Neither erases the operational progress. They are however, major blows in this turnaround too. ASOS has pushed its immediate repayment pressures further out, but the recovery still has a financing clock attached. Its £253 million convertible bond carries an 11% annual coupon and, if redeemed under its existing terms in September 2028, a £303.6 million repayment. That gives management time to rebuild demand, but it makes that time expensive. September’s trading update showed encouraging progress, including a return to quarterly GMV growth. The question now is whether ASOS can turn that progress into sustained cash generation while funding growth, servicing debt and absorbing whatever commercial fallout follows the breach.
They switched to institutional debt under Jose, buying them time without the pressure of investors. Banks will work harder to grow with their client. But still, a weak quarter can be hard to recover. Competition quietly still building a big following.
Shein reported UK revenue of £2.58 billion in 2025, up 26%, with pretax profit rising 18% to £45.2 million. That puts its UK revenue above ASOS’s entire reported global revenue for the financial year ended August 2025.
The comparison that interests me more is closer to home. ASOS reported UK revenue of £1.212 billion, down 9%. Different reporting periods and business models require care, but Shein’s reported UK revenue was roughly twice ASOS’s.
That should make us uncomfortable with explanations that lean too heavily on a difficult consumer environment. There was spending available. Shein was attracting considerably more of it. Consumers are buying with their budget, not their conscience. Shein’s moral quandary may not be a moral quandary.
It doesn’t tell us how many customers moved directly from ASOS to Shein. It does tell us that fixing your own business takes place against competitors who have no intention of waiting politely. I used to think consumers are fickle, they are not, Gordon Newman told me eloquently, we have a discerning customer. When I got his message, I dismissed it. Evidence displaces my gut feel.
Back in April, I focused on the quality of ASOS’s trading: buying better, reacting faster, reducing returns and selling more product without destroying the margin through promotions.
I still believe that work matters. It is the sort of mindset that internalises challenges. Turns inventory into money in the bank. It looks at the customer they have and not the one they lost.
I used to use their subject headlines as proof of how bad their sale and discount mentality was, it has changed dramatically. Newness and inso - seasonal messaging and a cap on discounts - 25% if the headroom. Again, a telling insight of change. This discipline should see them through the turmoil, you would hope. But a healthier commercial model has to produce something the customer actively prefers. Better inventory management can support that preference. It cannot substitute for it. The collaborations, curated edits and product newness were the promising part of the story. They offered a route towards making ASOS relevant again, beyond another discount appearing in another inbox.
Shein’s numbers raise the standard that relevance has to meet.
They also deserve scrutiny of their own. £45.2 million of UK pretax profit on £2.58 billion of revenue implies a margin of approximately 1.75%. Its subsequently reported global second-quarter results showed a 67% fall in adjusted net profit and a 13.9% decline in European revenue. The strong UK figures describe 2025; they don’t guarantee the same trajectory through 2026. Neither business gets to declare the job done. Shein, are doing well in Cross Border Trade, as I mentioned yesterday too. This is not, by any stretch a simple thing to do.
Then comes the breach.
ASOS says an attacker impersonated a trusted contact to obtain an employee’s login credentials, which were used to access third-party platforms. Some customer information was accessed. The company says its investigation found no payment-card information or account passwords accessed, and that its website and app remained safe to use.
Those distinctions matter. So does the fact that customers received an unauthorised notification through ASOS’s own app.In April, I saw the app and loyalty programme as important parts of the recovery. They offered the beginnings of a customer relationship that didn’t require ASOS to keep renting attention from Google. That relationship now faces a test.
We don’t know how many customers will disengage, disable notifications or hesitate before returning. We don’t yet have evidence of a measurable sales impact. But those are credible commercial risks worth watching. A customer doesn’t need to announce that they have lost confidence. They stop opening the app.
Faith no more.
For ASOS, that could mean more effort and expense to bring people back, precisely when the recovery needs repeat purchases and improving retention. Security response, customer communication and commercial recovery are now connected.
The breach cannot explain the earlier revenue gap with Shein. It could affect what happens next.The tests I set in April still apply: positive GMV, new customers returning for their second and third purchase, and margins holding as volume recovers. I would now add another: whether ASOS can preserve engagement with the channels it has worked so hard to rebuild. Finding a floor was never the same as finding a way back up. Shein’s results show how far the competition has moved. The breach introduces another obstacle into an already demanding climb. I still want to see ASOS succeed. I also want to see the customer evidence catch up with the operational progress.
We are living in this weird version of pre cog Minority report. You have to decide which side of this present you want to live in.
The tools of our trade have become part of the risk of our trade. The platform that brings customers back can carry an attacker’s message. The system that keeps stock moving can interrupt deliveries. The controller that protects fresh food can be used to destroy it.We don’t need to establish a geopolitical motive behind every incident to recognise the exposure. Retailers operate in a world where disruption has value to people whose objectives have nothing to do with selling products.
That makes resilience a commercial discipline.
Every investment in connection and automation needs an accompanying answer: what happens when we lose control of it, how far can the damage spread, and how quickly can we trade safely again? Till the next breach, I guess.