ASOS Breach Exposes Customer Data and Compromises App Notification System

Summary

Attackers who accessed an ASOS employee’s account reportedly reached third-party platforms, including its app notification system, and obtained customer information. The breach path and claimed Snowflake access remain unconfirmed.

Key points

ASOS said an unauthorized party impersonated a trusted contact and obtained an employee’s login credentials.
The attackers reportedly accessed information about third-party platforms and used ASOS’s mobile app notification system to message customers.
ASOS confirmed exposure of customer names, contact details, and non-personal account information; the BBC reported additional data including addresses, dates of birth, and search histories.
The attackers’ claimed access to ASOS’s Snowflake instance and use of the Simon AI platform have not been independently confirmed.
ASOS said payment information was not at risk; the article reports that the incident is separate from a July breach affecting nearly 140,000 people in the US.
Experts warn that customer-facing marketing and notification platforms can be underprotected despite their access to customer data and ability to send trusted communications.

Article Details

Victim Organization: ASOS
Incident Type: Unauthorized access following impersonation of an employee's trusted contact and compromise of the employee's login credentials
Data Types Exposed: Names
Contact details
Non-personal account-related information
Addresses (identified by the BBC)
Phone numbers (identified by the BBC)
Email addresses (identified by the BBC)
Dates of birth (identified by the BBC)
Customer ID numbers (identified by the BBC)
ASOS search histories (identified by the BBC)
Affected Records: Not disclosed. ASOS has around 17 million customers, but the article does not say how many were affected.
Operational Impact: The attackers accessed information about third-party platforms and used ASOS's mobile app notification system to send a message to customers. The attackers claimed to have fully compromised the Snowflake instance, but this was not confirmed. The article reports no confirmed operational outage.
Ransom Or Extortion: No ransom demand is reported. Xuanye Group said customer information was safe on its server and would not be touched for a designated period, which it told The Telegraph would be two weeks.
Claim Status: confirmed