Key takeaway: The breach shows how a single stolen employee credential can escalate quickly. Combined with access to a retailer’s own marketing and notification infrastructure, it can turn a routine phishing attack into a direct, high-visibility extortion channel to customers. It also shows how initial company statements about scope can lag well behind what attackers themselves disclose.
ASOS has confirmed a data breach after an unauthorized party obtained an employee’s login credentials through social engineering. Those credentials were then used to access third-party platforms the retailer relies on for customer communications and personalization.
The incident became public on October 6, 2026. Attackers used one of those platforms to send a fake “ASOS HACKED” push notification to app users in the UK, the US, Australia and elsewhere. The notification was addressed to ASOS’s data protection officer and IT team. It claimed the attackers had “fully compromised” the company’s Snowflake instance, adding, “Engage with us, or we will leak it.” The message linked to a Telegram channel run by a group calling itself Xuanye Group.
ASOS initially said only that “basic personal information including name and contact details may have been accessed.” On October 8, BBC News told the company it had been contacted by the attackers with a sample of stolen data. ASOS then confirmed a fuller account: an unauthorized party had gained access to an ASOS employee account by impersonating a trusted contact. The resulting credentials were used to access information on third-party platforms, including full names, contact details and certain non-personal account information.
The BBC’s reporting goes further, based on the sample the attackers provided. It indicates the data includes home addresses, phone numbers, customer numbers, dates of birth and customers’ website search terms. The attackers told the BBC they obtained this through Simon AI, a Snowflake-connected personalization platform ASOS uses for marketing. That broader picture has not been independently verified by ASOS’s own forensic investigation. It rests on what the attackers chose to share.
ASOS has not disclosed how many customers are affected. ASOS and Snowflake both say payment card details and passwords were not affected. Snowflake says its own platform was not compromised. Reporting also notes that Simon AI does not require multifactor authentication by default. That detail is still under scrutiny as the investigation continues.
Why it matters: A vendor’s own system security isn’t the only thing that determines how much customer data is exposed. Access controls and credential hygiene around employees and third parties matter just as much. Attacker-supplied disclosures can also outpace a company’s own initial statement by days.
Sources: TechCrunch; BleepingComputer