Key Takeaways
- Binance is dealing with a security incident affecting an estimated $6.3 billion in digital assets, with initial findings pointing to a compromised engineer’s laptop.
- The ASOS incident shows how attackers can use legitimate credentials, obtained by impersonating a trusted contact, rather than needing to bypass every technical defence.
- TFG London’s incident at Hobbs, Whistles and Phase Eight shows how quickly a cyberattack becomes a business continuity and data protection issue.
- Most organisations already have layered security in place. The challenge is knowing whether those controls will work together when tested.
- Testing realistic attack scenarios and continuously reassessing defences gives security leaders confidence that their existing investment delivers.
On this page
Just as Cybersecurity Awareness Month draws to a close, another major cyberattack has made headlines.
Today, cryptocurrency giant Binance is dealing with the fallout from a security incident affecting an estimated $6.3 billion in digital assets, with approximately $3 billion frozen on-chain.
And Binance is far from the only major name to make headlines this month.
ASOS, Hobbs, Whistles and Phase Eight have all experienced cybersecurity incidents throughout October, from compromised employee credentials to disrupted business operations and potential data exposure.
There’s a certain irony in seeing so many high-profile incidents during a month dedicated to cybersecurity awareness.
But for security leaders, these headlines raise a much more important question:
If organisations are investing heavily in cybersecurity, why are attackers still finding ways through?
Let’s look at what happened, what these incidents tell us about today’s threats, and what organisations can do to strengthen their defences.
October’s Biggest Cyber Incidents: What Happened?
Binance: Billions affected by a potential laptop compromise
On 30 October, Binance confirmed a security incident with an estimated impact of $6.3 billion. Its preliminary investigation suggests a compromised DevOps engineer’s laptop may have allowed attackers to access a service container and submit unauthorised withdrawal transactions.
Binance has reported that approximately $3 billion in affected assets have been frozen and says it will cover losses. The full technical root cause remains under investigation.
What can organisations learn?
- Protect privileged access: Regularly review who can access critical systems and ensure permissions are appropriately restricted.
- Secure development environments: Protect engineering workstations, credentials and deployment pipelines.
- Limit attacker movement: Ensure one compromised device cannot provide unrestricted access to sensitive infrastructure.
ASOS: When compromised credentials open the door
In early October, ASOS confirmed that an attacker had impersonated a trusted contact to obtain an employee’s login credentials. These were subsequently used to access customer information held on third-party platforms.
The incident demonstrates how attackers can exploit legitimate access rather than needing to bypass every technical defence.
What can organisations learn?
- Strengthen identity security: Use phishing-resistant MFA and least-privilege access.
- Verify unusual requests: Ensure employees have procedures for confirming unexpected requests involving credentials.
- Test detection capabilities: Understand whether suspicious account activity would be identified and contained quickly.
Hobbs, Whistles and Phase Eight: When cyber incidents disrupt business
TFG London, the company behind Hobbs, Whistles and Phase Eight, identified a cybersecurity incident on 11 October that disrupted IT systems and online ordering.
In a further update reported on 29 October, the company confirmed that some customer and employee personal data may have been accessed. Its investigation remains ongoing.
The incident highlights how cybersecurity can quickly become a business continuity and data protection concern.
What can organisations learn?
- Test business continuity: Could essential services continue if critical systems became unavailable?
- Validate recovery plans: Ensure restoration processes work under realistic conditions.
- Prepare across departments: Make sure security, IT, operations and leadership understand their responsibilities during an incident.
Why Are Organisations Still Being Breached?
Most organisations already have multiple layers of cybersecurity protection. The challenge is knowing whether those layers will work together effectively when tested.
A business might have MFA, endpoint protection and security monitoring in place. But are those controls configured correctly? Do they cover every critical system? Would they detect an attacker using legitimate credentials?
Three common challenges stand out:
- Security gaps aren’t always visible: Tools may be deployed, but weaknesses in configuration, coverage or access permissions can remain unnoticed.
- Attack surfaces keep changing: New applications, suppliers, cloud environments and identities introduce risks that weren’t present during previous assessments.
- Defences aren’t always tested against realistic attacks: Periodic assessments provide valuable insight, but environments and attacker techniques continue to evolve between tests.
The real question isn’t how many security tools you have. It’s whether you know they’ll work when it matters.
What Should Security Leaders Be Doing Differently?
The answer isn’t necessarily investing in another security tool. Often, the most valuable starting point is understanding how effectively your existing defences are performing.
Here are four practical priorities:
- Test realistic attack scenarios: Simulate compromised credentials, privileged access abuse and attacker movement to identify where existing controls could fail.
- Focus on critical assets and identities: Prioritise the systems, accounts and access routes that would cause the greatest business impact if compromised.
- Validate detection and response: Measure whether suspicious activity is detected, how quickly teams respond and whether an attack can be contained.
- Continuously reassess your security posture: Retest controls as your organisation changes, rather than relying solely on point-in-time assessments.
This is where continuous adversary operations can provide valuable insight. At OmniCyber Security, our WRAITH Continuous Adversary Operations service helps organisations test their defences against realistic adversary activity, identifying where security controls are effective and where improvements are needed.
It’s about understanding the protection you already have and making sure it delivers when it matters most.
Cybersecurity Awareness Month Shouldn’t End With Awareness
October’s headlines are a reminder that even organisations investing heavily in cybersecurity can still face significant threats.
That doesn’t mean security investments are wasted, or that breaches are inevitable. It means organisations need to continually test, validate and improve their defences as threats evolve.
For security leaders, the goal isn’t perfect protection. It’s understanding where your organisation is exposed, reducing the opportunities attackers can exploit and building confidence in your ability to respond.
If this month’s incidents have raised questions about your own security posture, our specialists at OmniCyber Security are here to help you understand your risks and identify practical ways to strengthen your defences.
Because investing in cybersecurity is important. Knowing it works is what makes the difference.
Amelia Frizzell
Amelia is Head of Marketing at OmniCyber Security, with a focus on Cyber Security content since 2016. She combines deep marketing expertise with hands-on knowledge of the cyber threat landscape to create clear, practical content that helps businesses improve awareness, reduce risk, and embed security best practice across their teams.
