The ASOS hack: why businesses need to pre-define what must keep running

The challenge is bigger than the breach

The ASOS incident is unlikely to be the last headline of this type. In recent weeks, reports have also emerged of cyber incidents affecting retailers including Hobbs, Whistles and Phase Eight, reinforcing the reality that disruption is becoming a regular feature of the retail landscape.

These recent incidents bring a critical business question into focus: if we switch off a compromised system, what else stops? 

ASOS has confirmed that attackers used compromised employee credentials to access information on third-party platforms. For highly digitalised retailers, the challenge is not simply securing individual systems, but understanding how those systems support essential operations and where disruption has a downstream impact.

Minimum Viable Business and how it strengthens operational resilience  

The concept of Minimum Viable Business (MVB) is increasingly being adopted by businesses as a practical framework for providing that clarity. Rather than treating every system as equally critical, it defines the essential business outcomes that must continue and maps the critical paths connecting them to technology, data, people and suppliers. This establishes both a recovery sequence for widespread disruption and an impact map for targeted shutdowns, ultimately establishing what must remain available, what can be suspended and which dependencies cannot be overlooked. 

What can organisations learn from the ASOS incident? 

For an organisation with a mature MVB approach, an incident involving compromised third-party platforms would trigger an informed assessment of containment options, downstream impacts and tested workarounds. ASOS reports that affected platforms were quickly locked down and its website and app remained safe to use, but the extent of the incident, data breach and damage to reputation and consumer confidence will likely only be fully realised in the coming weeks and months.  

It’s important to understand that MVB can’t prevent breaches. Rather, it’s an organisation-wide understanding of what can safely be switched off, what must keep working and how the two are connected. This understanding should now be a minimum expectation of effective cyber resilience. Organisations don’t need to wait for the next major cyber incident to start building resilience. A practical starting point is to bring business and technology leaders together now, define what must continue and turn that shared understanding into clear recovery priorities, actionable playbooks and realistic exercises 

Many organisations already recognise the need to improve recovery readiness but are unsure where to start. 

For business leaders exploring where to begin, or to accelerate their existing efforts, our MVB approach offers a practical starting point for bringing business and technology leaders together around what must continue. 

Key takeaways

• Decide and define what the business cannot operate without
• Know the dependencies that support critical services
• Identify what can safely be switched off