The first sign of the ASOS breach did not come from the company. It came from the ASOS app. On Tuesday 6 October, customers’ phones lit up with a push notification that was not written by ASOS.
According to CPO Magazine, the message was addressed to the retailer’s data protection officer and IT staff.
ASOS said an unauthorised notification had been sent to customers.
The alert linked to a newly created Telegram channel and claimed the attackers had fully compromised the company’s Snowflake instance.
What ASOS says was taken
TechCrunch reports that ASOS told the London Stock Exchange that
hackers broke into a third-party platform that holds data the company uses to communicate with customers
. The company said names and contact information were taken. Reporting cited by TechCrunch from the BBC adds that the data includes home addresses, phone numbers and email addresses, plus notes on customer profiles such as website search queries.
The UK’s National Cyber Security Centre says ASOS
does not believe payment card information or account passwords were affected
. The group behind the attack, which calls itself “Xuanye Group”, also claimed it had stolen customer data but not payment details, according to BleepingComputer.
ASOS has not, in the sources reviewed, given a figure for how many customers were affected. Some outlets have said millions, but that number has not been confirmed by the company here.
How the attackers got in
ASOS later said the cause was social engineering. In a notice shared with BleepingComputer, the company said an unauthorised party gained access to an employee account by impersonating a trusted contact to obtain login credentials. Those credentials were then used to reach data on third-party platforms.
That is a familiar pattern. No software flaw was needed. A convincing request to one person was enough.
The rogue push notification also looks like a pressure tactic. TechCrunch notes that using the app’s own notification system lets hackers push the company to talk to them, or risk the stolen data being published online.
What customers should do
Stolen contact details are rarely used right away. The NCSC warns that suspicious messages can arrive some time after a breach, so vigilance matters for months, not days.
- Treat unexpected emails, texts and calls about orders, refunds or “account problems” with suspicion, even if they use your name and address correctly. Those details are now in criminal hands.
- Do not tap links in messages. Open the ASOS app or type the website address yourself.
- Be wary of any notification that points you to Telegram or another outside channel, including ones that look like they came from the app.
- Change your password anyway if you reuse it elsewhere, and turn on two-step verification. ASOS says passwords were not affected, but reuse is a risk in any breach.
- Never share one-time codes with anyone who contacts you, whoever they say they are.
- Read the NCSC’s data breach guidance for further steps.
A lesson for staff, too
For organisations, the case shows how much damage one compromised employee login can do when it opens access to outside platforms that hold customer data. Verifying unusual requests through a second channel, limiting what each account can reach, and requiring multi-factor authentication on third-party tools all narrow that exposure.
ASOS is investigating and sending updates to affected customers. Whether the attackers publish the data remains unknown.