ASOS has confirmed a data breach that started with one employee being tricked into handing over login credentials, which were then used to reach customer data on third-party platforms the retailer uses. The incident first became public when customers received an unauthorized push notification through the ASOS app.
What happened
On October 6, 2026, ASOS customers received an unauthorized push notification in the ASOS mobile app. BleepingComputer reports it alleged customer data theft and urged ASOS staff to contact the attackers on Telegram. The Record reports the alert linked to a Telegram channel run by a previously unknown group calling itself "Xuanye Group."
In a statement on its website, reported by BleepingComputer on October 8, ASOS said an unauthorized party got into an employee account by impersonating a trusted contact to obtain login credentials. Those credentials were then used to access information on "certain third-party platforms used by ASOS." ASOS has not named the platforms.
According to ASOS, the exposed data includes names, contact details and some non-personal account information. The company says payment card information and account passwords were not affected. It has not said how many customers are affected, and BleepingComputer got no answer when it asked. ASOS says it locked down the affected platforms and is investigating with external experts, law enforcement and regulators. It says customers don't need to take any action on their accounts, but should be wary of unsolicited messages and never share passwords, security codes or payment details.
On Telegram, Xuanye Group claimed it had compromised ASOS's Snowflake environment and an integrated service called Simon AI, The Record reports. ASOS has not confirmed either claim. The UK's National Cyber Security Centre published a notice telling all ASOS customers to assume they are affected, whether or not they received the notification.
Why it matters
This follows a pattern that keeps repeating: the attacker didn't break the retailer's own systems. They got one employee's credentials through impersonation and used them on third-party platforms that held customer data. ASOS hasn't said whether the employee account had MFA or how sign-in to those platforms works, so don't assume either way. The lesson holds in both cases. Every third-party platform that can read customer records or send messages under your brand is part of your identity attack surface. Each one needs the same sign-in controls and access review as your core systems.
The push notification is the part to think about. ASOS hasn't said exactly how the alert was sent, but someone was able to message app users under ASOS's name. Marketing and messaging tools are often owned outside IT and security, set up with shared or local accounts, and given broad data exports. That makes them easy to miss in access reviews.
Customers face phishing risk too. Names and contact details are what attackers need for convincing follow-up messages, which is why ASOS and the NCSC both warn about unsolicited contact.
What to check in your environment
- Inventory platforms that hold customer data or can message customers. Include push notification, email, SMS, CRM and data warehouse services. For each one, record who owns it and how users sign in.
- Put those platforms behind your SSO and require phishing-resistant MFA. Where a platform still allows local username/password logins alongside SSO, turn those off or restrict them to break-glass accounts.
- Review who can send to your whole customer base. Limit broadcast and campaign-send rights to a small named group, and require approval for sends where the platform supports it.
- Check bulk-export rights. Find which accounts can export or query full customer tables, and remove that right from anyone who doesn't need it for their job.
- Test your help desk and staff against impersonation. The way in here was someone posing as a trusted contact. Make sure staff know to confirm credential or access requests through a separate, known channel.
- Prepare a customer-messaging kill switch. ASOS says it locked down the affected platforms after the incident. Know who can revoke sessions and API keys on your messaging tools, and how fast.