ASOS says one tricked employee opened the door to third-party platforms — and shoppers should now watch for follow-up scams, not just the rogue alert itself
October 8, 2026 — ASOS confirmed on Thursday that its recent data breach began with a social engineering attack, after an unauthorised party impersonated a trusted contact and obtained an employee's login credentials, then used them to reach information on third-party platforms used to communicate with customers.
Image: A smartphone alert, a shopping app and a hooded figure stealing a login key, illustrating the ASOS social-engineering breach. Credit: AI-generated illustration / Red Eye Eagle News, original illustration.
Editor's Highlight: The key shift on October 8 is certainty about the entry point. According to ASOS, this breach started with stolen employee credentials — a people-and-access failure, not only a hacking story.
Table of Contents
- Key Facts
- How the Breach Unfolded
- What Data Was Exposed — and What Was Not
- The Snowflake Claim and the Simon AI Question
- Who Is Behind the Xuanye Name?
- What Customers Should Do
- Why Retail Breaches Start With People
- Bottom Line
- FAQ
- Sources
Key Facts
| Detail | Information |
|---|---|
| Retailer | ASOS, UK online fashion retailer |
| Confirmed update | October 8, 2026 customer security notification |
| Entry point | Employee credentials obtained by impersonating a trusted contact |
| Systems reached | Certain third-party platforms used by ASOS |
| Exposed, per ASOS | Full names, contact details, some non-personal account information |
| Not accessed, per ASOS | Payment card information and account passwords |
| Rogue notification | Sent through the ASOS app on October 6, 2026 |
| Regulator | UK Information Commissioner's Office notified, assessing |
How the Breach Unfolded
Most customers learned something was wrong from their phones. On October 6, an unauthorised push notification reached users through the official ASOS app.
It was addressed to the company's data protection officer and IT team, claimed a Snowflake instance had been compromised, demanded engagement, and pointed to a Telegram channel.
ASOS first confirmed the unauthorised notification and an investigation. The fuller cause came on October 8, in a customer update reported by BleepingComputer, Infosecurity Magazine and TechCrunch.
What Data Was Exposed — and What Was Not
ASOS says full names and contact details were exposed, plus certain non-personal account-related information. It says payment card information and account passwords were not accessed.
Reporting by the BBC, relayed by TechCrunch and Infosecurity Magazine, suggests a sample shown to the broadcaster may have included addresses, emails, customer numbers and website search terms — not a verified full dataset.
ASOS has not given a figure for customers affected. BleepingComputer reported it asked for that number and had not received one.
| Category | ASOS position | Status |
|---|---|---|
| Names, contact details | Exposed | Confirmed |
| Payment cards, passwords | Not accessed | Confirmed |
| Customers affected | Number not given | Unknown |
| Wider Snowflake claim | Not confirmed | Disputed |
The Snowflake Claim and the Simon AI Question
The rogue notification claimed a Snowflake instance had been fully compromised. Snowflake, a cloud platform for storing and analysing large datasets, says its own platform was not compromised, and that it began investigating once it became aware of the notification.
One possible link discussed by researchers is Simon AI, a marketing platform used by ASOS. A Malwarebytes researcher noted, as reported by Infosecurity Magazine, that Simon AI is built on Snowflake technology and could be indirectly linked.
The BBC reported the actor claiming a Simon AI instance was compromised; Monetate, which acquired Simon AI in July, was contacted for comment. That remains an unconfirmed line of inquiry.
Tech Analysis: A compromised account on a connected marketing service is very different from a breach of a cloud provider itself — even when the same brand names appear in both claims.
Who Is Behind the Xuanye Name?
The actor calls itself the Xuanye Group, a name researchers say had not previously been linked to cyberattacks.
Group-IB researcher Anastasia Tikhonova found the Telegram channel in the notification was created on October 6, and that the account behind it had earlier used names linked largely to gaming-item trading, including JohnCZ and Moon Transfers.
That history does not identify who controls the account now.
What Customers Should Do
ASOS says its website and app remain safe to use, and that no action is needed on customer accounts, according to its notification reported by BleepingComputer.
The practical risk now is follow-up deception. Names and contact details are exactly the material used to make phishing look personal.
- Be cautious of unexpected messages or calls claiming to be from ASOS.
- ASOS says it will never ask for passwords, security codes or payment details through an unsolicited message or call.
- Do not engage with the Telegram link in the rogue notification.
- Use the official app or website directly, not links in unexpected messages.
Practical Takeaway: Even though passwords were not accessed, according to ASOS, contact details alone can power convincing scams. Treat urgent ASOS-branded messages in coming weeks with extra suspicion.
Why Retail Breaches Start With People
The confirmed entry point was not a smashed firewall. It was, according to ASOS, a person persuaded to hand over credentials by someone impersonating a trusted contact.
ASOS says it locked down the affected platforms and added security measures. Whether multi-factor authentication protected the compromised account remains unclear, TechCrunch noted.
Analysis Note: Attackers do not need the front door if a trusted side service holds customer data and a route to shoppers' phones.
Bottom Line
ASOS has confirmed the core facts: stolen employee credentials, access to third-party platforms, and exposure of names and contact details, with payment cards and passwords not accessed, according to the company.
What to watch next is scale — the number of customers affected, the status of the Snowflake and Simon AI claims, and any findings from the Information Commissioner's Office.
FAQ
How did the ASOS breach happen?
According to ASOS, an unauthorised party impersonated a trusted contact to obtain an employee's login credentials, then used them to access information on certain third-party platforms.
What customer data was exposed?
ASOS says full names, contact details and certain non-personal account-related information were exposed. Payment card information and account passwords were not accessed, according to the company.
Was Snowflake itself breached?
Snowflake says it found no compromise of its own platform. The attacker's claim about a Snowflake instance has not been confirmed by ASOS.
Is the ASOS app safe to use?
ASOS says its website and app remain safe to use. It advises caution about unexpected messages claiming to be from the company.
How many customers were affected?
ASOS has not yet given a number. Its investigation is ongoing, and it says it will share updates if important findings emerge.
Sources
- BleepingComputer — ASOS links breach to social engineering and credential theft: https://www.bleepingcomputer.com/news/security/asos-links-data-breach-to-social-engineering-attack-credential-theft/
- Infosecurity Magazine — ASOS confirms breach linked to stolen employee credentials: https://www.infosecurity-magazine.com/news/asos-data-breach-stolen-employee/
- TechCrunch — ASOS confirms breach after rogue app notification: https://techcrunch.com/2026/10/08/asos-confirms-breach-of-customer-data-after-hackers-send-rogue-app-notification/
- Insurance Journal / Bloomberg — Hackers tricked ASOS employee to steal login: https://www.insurancejournal.com/news/international/2026/10/08/888419.htm
- BBC News via YouTube — Asos: What we know so far (video above): https://www.youtube.com/watch?v=LQhvs6arDhw
- Image: AI-generated illustration / Red Eye Eagle News, original illustration.
Join the conversation
Comments
Post a Comment