This week, thousands of ASOS customers received an app notification reading “ASOS HACKED”, sharing an alleged ransom note from hackers. 

The message claimed attackers had compromised the retailer’s Snowflake Cloud date instance and threatened to leak the data unless ASOS engaged with them. 

For any business, the lesson is clear: a cyber incident isn’t just an IT problem. It has the potential to hit customer trust, reputation and share price within hours. 

That’s why it matters to know what hackers know about your business before they use it, and it’s exactly what NordStellar is built to show you.  

Your cloud, your responsibility: who can get in? 

Whilst the full details of the hack haven’t been released, ASOS initially stated that only basic contact details may have been accessed, but the BBC has since found the hackers took far more. This included addresses, customer numbers and even customers’ search histories, meaning future hackers could run targeted scams based on previous item searches. 

How the attackers got in hasn’t been confirmed. But the pattern is a familiar one: stolen credentials are behind 81% of breaches, and those details tend to sit on the dark web long before anyone uses them. 

It’s a reminder that data isn’t automatically safe just because it sits with a major cloud provider.  

The provider secures the platform, but the business is responsible for who can get in, which means user accounts, permissions and passwords sit on your side of the line. 

Once data is exposed, it rarely stays in one place. It’s often bought, sold and shared long before anyone tries to use it. 

What happens to exposed password details? 

The longer a breach goes unnoticed, the more damage it can do. IBM’s Cost of a Data Breach Report 2026 puts the average time to identify and contain a breach at 247 days, and the average cost to UK organisations at £3.13 million.  

It’s the part of the internet that search engines don’t indicate, and it’s where stolen information is regularly bought, sold and shared. 

For a business, the difficulty is visibility. From the outside, there’s no way to see what’s listed, and no alert when something appears.  

That’s the gap dark web monitoring is designed to cover. 

What sits outside your business 

For most businesses, the hardest part is knowing what’s out there in the first place, and that’s what NordStellar, our premium dark web monitoring service, is designed to show you.  

It helps protect the personal identities of your staff, so you can see what’s on the dark web before hackers find it first.  

Most businesses aren’t short of security tools. What they’re short of is visibility outside their own walls, and stolen logins are only part of the picture. Four gaps tend to sit there: 

Staff credentials leak through other people’s breaches: Third-party breaches, malware and combo lists can expose a login without anything going wrong inside your business. 

Lookalike domains impersonate you: Someone registers a near-identical address and uses it to phish your clients in your name. 

Unknown assets sit outside every internal tool: Forgotten domains, IP addresses and open ports can’t be protected if nobody knows they exist. 

Few businesses can see what’s being shared about them: Dark web forums, Telegram channels and ransomware blogs aren’t part of any internal monitoring. 

NordStellar closes those gaps. It looks in the places your internal tools can’t reach, so you find out about a problem as it appears, not once it’s been used against you.  

What does NordStellar do? 

Developed by Nord Security, NordStellar covers all four: 

Dark web monitoring: Tracks your company’s keywords across forums, Telegram, ransomware blogs and marketplaces. 

Leaked data management: Detects employee and consumer credential leaks from breaches, malware and combo lists. 

Domain squatting detection: Monitors for lookalike domains continuously, with risk scoring and evidence. 

Attack surface management: Discovers your domains, IPs and vulnerabilities, scored with CVE, CVSS and EPSS. 

Alerts go to email, Slack, Teams or webhooks, so the right people hear about it where they already work. 

The result is simple. Instead of hoping nothing has leaked, you have something watching for you. 

Monitoring is one layer: 

No single tool solves this. NordStellar works best alongside good basics, and four questions will show you how strong yours are: 

Is MFA enforced on every cloud account? Not “available” or “encouraged”, but enforced. 

Who has access to your data platforms, and do they still need it? Leavers, contractors and old integrations are common weak points. 

Would you spot unusual activity before anyone contacts you? If your first alert would be a message from an attacker, the answer is no. 

Has your incident response plan been tested? A plan nobody has rehearsed is just a document. 

If you’re not sure of the answers, talk to our team. 

Know before they do 

Every business has the same question to answer: how soon would you know if something was exposed? This week’s notification shows how quickly things move, and why early warning signs matters. 

Want to feel confident in your security? Talk to our team about NordStellar and be confident you’d hear about exposure first.