ICO fines & breach roundup — 14 October 2026

A plain-English look at recent UK Information Commissioner's Office (ICO) enforcement and notable data-protection news — who was penalised, why, and what a small business should learn from it. The pattern is consistent and the lessons are cheap to act on.

The enforcement register itself has published nothing new since 29 September — we checked it directly, and the two police reprimands that led last week's edition are still the most recent entries. So this is a week of breaches and regulator signals rather than fines: two UK fashion retailers hit six days apart, the ICO's own numbers showing automated nuisance-call complaints nearly tripling in three months, and the regulator setting out what it expects from AI agents. One naming note while we are here — on 30 September the regulator's legal form changed from a single office-holder to a board, and it is now the Information Commission. It confirmed on the same day that the organisation is still "referred to as the Information Commission's Office, or ICO", which is why the ASOS statement below is signed by a Chief Executive rather than a Commissioner. Nothing about your obligations changed.

1. ASOS: the attackers announced the breach themselves, through ASOS's own app — and it started with one employee account

On the morning of 6 October ASOS customers opened their phones to a push notification from the ASOS app titled "ASOS HACKED", pointing them at a Telegram channel. The message was addressed, as Out-Law reported it, "Dear Asos DPO [data protection officer] and IT, we have fully compromised the Snowflake instance" — Snowflake being a cloud data platform used by a great many large businesses. ASOS, which has around 16.5 million customers across more than 150 markets, confirmed it was investigating unauthorised third-party access, emailed an apology to customers that evening, told people to ignore the notification and not click the links, and said the website and app were "operating as usual". Its shares fell more than 10% on the London Stock Exchange.

Two days later ASOS said how it began. According to The Record, the company said an unauthorised party obtained an employee's login credentials by impersonating a trusted contact, and those credentials "were then used to access information on certain third-party platforms". Its investigation found that names and contact details, plus certain non-personal account information, were accessed; ASOS says no payment card information and no account passwords were accessed, and has not asked customers to reset passwords. Be clear about what is not established. ASOS has not said how many customers are affected or whether data was copied. Snowflake denies any compromise of its own platform, saying the incident "did not in any way result from a vuln, weakness, flaw or misconfiguration with the Snowflake service, platform or internal environments" and that no remediation is required for its customers; the link between the employee account and any Snowflake environment has not been publicly established. A previously-unknown group calling itself Xuanye Group posted the notification and made the Snowflake claim — that is the group's own claim, not a finding, and researchers have not verified it; its further claim to hold customers' search history is likewise unverified. The ICO did not announce an investigation. On 7 October it published a statement in which Paul Arnold, Chief Executive, addressed the public rather than the company: "We understand how unsettling it can be to receive a message from apparent hackers claiming to have access to your personal information… Be cautious of any links or attachments, and do not click on links in unexpected texts or emails claiming to relate to your account." He added the two habits that outlast any one breach: "using strong, unique passwords and enabling multi-factor authentication can help keep accounts secure." Whether and when ASOS notified the regulator has not been confirmed publicly. There is no ICO finding, no penalty and no technical account of the intrusion — this is a live incident, not a case.

What your business should learn: The expensive-sounding parts of this story are not the lesson. The lesson is that somebody talked an employee out of their password, and that one account turned out to reach customer data held somewhere else entirely. Three cheap actions follow. First, put multi-factor authentication on every staff account that can reach customer data — including the ones that only sign in to someone else's dashboard. Most owners have MFA on email and nothing on the booking system, the email-marketing tool, the stock platform or the analytics console, because those feel like someone else's software. They are exactly where your customer list lives, and a stolen password with no second factor is the whole attack here. Second, write down which outside platforms hold your customers' data, and who in your business can log into each. ASOS's breach reached "certain third-party platforms" through a single internal account; you cannot protect a list you have never made, and the list usually takes twenty minutes and surprises the person making it. Third, decide now how you would tell customers, because you may not get to choose the moment. The genuinely new thing here is that the attackers reached ASOS's customers before ASOS did, using ASOS's own notification channel. Agree in advance what a holding message says, who signs it off and which channel it goes out on — and make it the boring, factual kind: what you know, what you do not know yet, and the one thing customers should watch for. When what leaks is names and contact details, that thing is almost always phishing: say plainly that you will never ask them to confirm payment details by email or text, and most of the follow-on harm dies there.

2. Phase Eight, Hobbs and Whistles: the second UK fashion retailer in six days, and a textbook first statement

On Sunday 11 October, TFG London — the UK arm of The Foschini Group, which owns Phase Eight, Hobbs and Whistles — identified what it called a "cybersecurity incident" affecting some of its IT systems. It disclosed this publicly on 13 October. The company said it is investigating with external cybersecurity specialists, has reported the incident to the relevant UK authorities, and has "no reason to believe that payment information is at risk". Physical stores stayed open; some brand websites had limited functionality. At the time of writing, TFG London has not confirmed whether customer personal data was accessed, how the attackers got in, or whether ransomware was involved, and there is no ICO comment or finding. Some coverage reports that an unauthorised party accessed names and contact details; we could not confirm that against a company statement, so treat it as unverified. The incident came six days after the ASOS notification and prompted a run of "UK retail under attack" headlines — but nothing publicly links the two incidents, and the sensible reading is that two retailers were hit in the same week, not that one campaign hit both.

What your business should learn: Compare the two statements, because the contrast is the lesson and it costs nothing to copy. TFG London's first public words did the four things a first statement should do: said when it found the problem, said what is still running, said who it has told, and said what it does not yet know. That is a strong position to be in on day three of an investigation, and you can draft it today, before anything has happened, with the specifics left blank. The habit worth building is reporting first and investigating second. If personal data is involved and there is a risk to people, you have 72 hours from becoming aware to notify the ICO — and "aware" starts when you have a reasonable degree of certainty that a breach has occurred, not when you have finished working out what happened. You can report with gaps and update later; you cannot un-miss the deadline, and a late report is its own, separate failing on top of the breach. Second, note what kept the shops open. Websites went down and back-office order processing was disrupted, but the physical stores traded through it. That is what having a manual fallback looks like. For a small business the equivalent questions are: if your booking system, card terminal or email went down tomorrow morning, could you still take money and still know who is coming in? A printed copy of tomorrow's appointments and a backup card reader are unglamorous, cheap, and the difference between a bad day and a closed one.

3. Automated nuisance-call complaints hit a five-year high — and the ICO has issued £2.37m of fines since April 2025

On 9 October the ICO published its own complaint data, and the trend is steep: complaints from the public about automated nuisance calls rose from 1,374 in July to 2,178 in August (up 58%), then a further 69% to 3,684 in September — the highest level since 2021, and close to a tripling in three months. The regulator says the real figure is higher, because most people hang up without reporting. Andy Curry, Head of Investigations, said: "The sharp rise in complaints about automated calls is deeply concerning. These calls are not just a nuisance; they can cause real distress and are often designed to manipulate people into handing over personal information or money… The numbers we're seeing are likely to be just the tip of the iceberg." The ICO links the rise to automated and AI-enabled marketing calls ("robo calls"), and to calls used to push people into WhatsApp groups or into handing over personal information. The enforcement context is the part businesses should read: since April 2025 the ICO has issued 15 Monetary Penalty Notices for nuisance calls and spam texts, totalling £2,370,000, and it says it has live investigations running. It names Home Improvement Marketing Ltd and Green Spark Energy, collectively fined £550,000 last year for making automated marketing calls unlawfully. This is PECR enforcement — the Privacy and Electronic Communications Regulations — which sits alongside UK GDPR and governs marketing calls, texts and emails.

What your business should learn: Two different readings, depending on which end of the phone you are on. If you market by phone, text or email, this is the ICO telling you where its attention is, and PECR is the one area where a genuinely small business gets fined real money — these are six-figure penalties against ordinary trading companies, not tech giants. The rules that catch people out are specific. Automated calls — a recorded message played without a live person — need the called person's prior consent, full stop; the Telephone Preference Service is not the test and screening will not save you. Live marketing calls must be screened against the TPS, and the register is only as good as the last time you checked it, so screen before each campaign rather than when the list was bought. And the consent you rely on has to be yours to rely on: a box ticked on somebody else's website, with your company not named, is the single most common reason a bought list turns into a penalty. Keep the record that shows who consented, when, and to what — if you cannot produce it, you do not have it. If you are on the receiving end, the practical advice is the ICO's own: register with the TPS free of charge, don't answer unrecognised or withheld numbers, and report the calls, because complaint data is what builds the investigations. Fraud and scams go to Report Fraud (or Police Scotland), silent and abandoned calls to Ofcom.

4. "The fact AI agents act with autonomy is not an excuse for poor compliance" — the ICO's clearest line yet on buying AI

On 8 October the ICO published the outcome of its scrutiny of ten foundation-model developers — Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI — saying each made or committed to make changes: clearer transparency information, stronger mechanisms for people to exercise their data rights, and tougher assessments of safeguards, with the ICO monitoring progress against those commitments. (X.AI is not in the group; the ICO paused engagement after opening a formal investigation into its Grok system, which is ongoing.) The more consequential half is about AI agents — models that complete tasks, use tools and interact with websites with limited human oversight. The ICO says the risk is shifting from how AI is trained to how agents behave once deployed, and it has made enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute about recent agentic testing, following reports that some agents bypassed protections, used unauthorised communication channels and reached external systems. Richard Nevinson, Director of Technology Regulation, put the principle plainly: "the fact AI agents act with autonomy is not an excuse for poor compliance." A call for evidence on agentic AI is open until 20 November 2026, and will feed the forthcoming statutory code of practice on AI and automated decision-making.

What your business should learn: Read past the named tech companies — none of this is aimed at you, and all of it lands on you anyway. The quote is the whole lesson: if you point an AI tool at your customers' data, you are the controller, and "the tool did it" is not a defence. Small businesses are adopting exactly the thing the ICO is now watching — an assistant that reads the shared inbox and drafts replies, a bot that answers website enquiries, something that sorts bookings or chases invoices. Each of those is a tool you have given access to other people's personal data. Three cheap habits before you switch the next one on. First, check what the tool does with what you feed it — specifically whether your data is used to train the vendor's models, where it is stored, and how long they keep it; it is in the terms, and if you cannot find it, that is an answer. Second, give it the narrowest access that works. An agent connected to your whole inbox and drive can act on everything in them, including the messages customers wrote you in confidence. Third, keep a human in front of anything the tool does to a person — refusing a booking, flagging an account, sending a chasing letter. Decisions made about people by software, with no human involved, carry extra obligations under UK data protection law, and they are also just where the embarrassing mistakes happen. None of that needs a consultant: it needs a short note of what each tool can reach, and a rule that it drafts rather than sends.

Sources

Compiled from public ICO enforcement notices and UK data-protection news. For awareness only — not legal advice, and not affiliated with the ICO. Always check the ICO's own published notices for the authoritative detail.

ICO fines & breach roundup