ASOS Cyberattack: Is Your Cyber Business Interruption Insurance Enough?
The recent ASOS cyberattack highlights an important question for businesses: even if your systems are restored quickly, how long could the financial consequences last?
On 6 October 2026, online fashion retailer ASOS confirmed it was investigating a cyber incident after customers received unauthorised notifications through its app. The company subsequently confirmed that an unauthorised party had obtained employee login credentials by impersonating a trusted contact, allowing access to information held on certain third-party platforms.
Although ASOS confirmed that its website and app remained operational, customer information was accessed, raising understandable concerns about data security and customer confidence.
For businesses of all sizes, the incident serves as a reminder that the financial consequences of a cyberattack aren’t necessarily limited to the time it takes to resolve the technical problem.
The Cyber Incident Might Last Days. The Financial Impact Could Last Weeks.
When businesses consider Cyber Business Interruption insurance, they often focus on how long their systems might be unavailable.
But what happens after those systems are restored?
Imagine an online retailer suffers a significant cyberattack. Its technical team might resolve the immediate problem within 48 hours, but customers could remain reluctant to make purchases for considerably longer.
Even where a business can demonstrate that its systems are secure, rebuilding customer confidence may take time.
This could mean reduced sales, cancelled orders or customers choosing competitors.
The ASOS incident provides a useful example of why businesses should think beyond the immediate technical consequences of a cyberattack.
Is £1 Million of Cyber Business Interruption Cover Really Enough?
As businesses grow, their insurance arrangements need to grow with them. A £1 million Cyber Business Interruption limit might initially sound substantial. However, for a business generating significant annual turnover, it could represent a relatively short period of lost or reduced trading.
Consider a business generating £25 million in annual revenue.
That equates to approximately:
- £480,000 in weekly revenue
- £960,000 over two weeks
- £1.44 million over three weeks
These figures represent revenue rather than an insured Business Interruption loss, which will depend on factors such as lost gross profit, savings in costs and the policy’s basis of settlement.
Nevertheless, they demonstrate how quickly the financial exposure can become significant.
What About the Loss of Customer Confidence?
One of the less obvious consequences of a cyberattack is the potential impact on customer behavior. Even after the immediate incident has been resolved, a business might experience reduced trading because customers are concerned about the security of their information.
Depending on the policy wording, Cyber Business Interruption insurance may respond to qualifying financial losses that continue after systems have been restored.
However, not every Cyber policy automatically covers third party supply chain issue and less are likely to cover reputational damage or reduced customer confidence.
There must generally be a covered event and a demonstrable insured loss. Some policies may provide specific reputational harm extensions, while others restrict cover to losses arising directly from an insured interruption.
This is why reviewing the actual policy wording is just as important as reviewing the monetary limit.
How Much Cyber Business Interruption Cover Should You Have?
Rather than choosing an arbitrary figure, businesses should consider their actual financial exposure.
Some useful questions include:
- What would one week’s lost or significantly reduced trading mean financially?
- What about two or three weeks?
- How dependent is the business on its website, software or third-party platforms?
- Could an incident involving customer data affect sales after systems are restored?
- Does the policy cover dependent business interruption involving external service providers?
- Does the existing limit allow sufficient room for both immediate and longer-term insured losses?
The answers can help determine whether the current insurance arrangements remain appropriate.
Your Cyber Insurance Should Reflect the Business You Are Today
If your turnover has increased substantially while your Cyber Business Interruption limit has remained unchanged, it may be time to reconsider whether that limit still provides sufficient protection. The recent ASOS incident is a reminder that cyber risks aren’t simply about IT systems going offline. They can involve customer data, third-party providers, reputational concerns and potentially wider financial consequences.
The question isn’t simply how quickly your business could recover from a cyberattack. It’s how long the financial impact could continue afterwards.
Review Your Cyber Insurance with Clarke Williams
At Clarke Williams, we help businesses review their Cyber insurance arrangements, assess potential Business Interruption exposures and explore alternative limits. Whether you’re an online retailer, technology company or another business heavily reliant on digital systems, it’s worth making sure your cover reflects your current size and exposure.
Call us on 01732 252 898 or email info@clarkewilliams.co.uk to discuss your Cyber insurance.
