Online fashion retailer ASOS has confirmed that hackers accessed customer information after gaining entry to an employee’s account, with the attackers also using the company’s mobile app to send a threatening notification to shoppers.
The breach came to light on October 6, when customers received a notification titled “ASOS HACKED,” demanding that the company’s data protection and IT teams make contact or risk having customer information leaked. The alert contained a link to a Telegram channel and claimed the attackers had compromised a Snowflake data system.
ASOS initially warned that customers’ names and contact details might have been accessed. However, an October 8 investigation by BBC News revealed that the stolen information also included customers’ home addresses, dates of birth, and shopping searches.
With ASOS boasting of about 17 million customers, it has not disclosed how many people were affected.
How Hackers Gained Access to ASOS Customer Data
According to an October 8 update from ASOS, the attack began when someone impersonated a trusted contact and tricked an employee into revealing their login credentials.
The hackers then used those credentials to access information stored on third-party platforms that ASOS uses to communicate with its customers, allowing them to send unauthorised notifications directly through the company’s mobile app.
The attackers, who identified themselves as Xuanye Group, claimed they had gained access through Simon AI, a customer personalisation platform built on Snowflake. However, this specific claim has not been independently verified, and Snowflake has maintained that it found no evidence of a breach affecting its own platform.
Still, the decision to send the threatening message through ASOS’s app was particularly unusual. Charlotte Wilson, head of enterprise at cybersecurity firm Check Point, described the incident to the BBC as attackers having “turned ASOS’s own app into their ransom note.”
What Customer Information Was Exposed?
The information obtained by the hackers extended beyond the basic contact details ASOS initially mentioned.
BBC News, which reviewed a sample of the stolen data provided by the attackers, found that it contained customers’ full names, email addresses, phone numbers, home addresses, customer identification numbers, and dates of birth.
The records also included customers’ shopping searches and information about when they first started using ASOS, including terms such as “reclaimed vintage” and “glamorous wide fit.”
Although ASOS has confirmed that no payment card information or account passwords were accessed, cybersecurity experts have warned that the other stolen details could help criminals create convincing phishing messages.
For instance, attackers could use customers’ names, contact information, and shopping interests to impersonate ASOS in messages about purchases, deliveries, or account problems.
ASOS Responds as Investigation Continues
Following the breach, ASOS immediately restricted access to the affected third-party platforms and launched an investigation involving its internal security teams, external cybersecurity specialists, and relevant authorities.
The company has also introduced additional security measures and maintained that its website and mobile app remained safe to use throughout the incident.
ASOS has advised customers that they do not need to make changes to their accounts. However, it has warned them to remain cautious of unexpected messages or calls requesting passwords, security codes, or payment information.
The incident has also affected investor confidence, with ASOS shares closing nearly 10% lower on October 6, according to The Guardian.
For now, the retailer’s investigation remains ongoing, with the total number of affected customers still unknown. And the breach raises concerns about how access to a single employee account can expose customer information and allow attackers to misuse the communication platforms that businesses rely on to reach their users.
