ASOS reportedly lost a staff login to a trusted-contact impersonation, and its own app announced the breach

Earlier this week, ASOS suffered a breach that began with a conversation, not an exploit. According to reporting by BleepingComputer, an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact in order to obtain login credentials. On 6 October 2026, customers across the UK began receiving push notifications through the ASOS app with the title "ASOS hacked", addressed to the company's data protection officer and IT team.

The credentials did the rest. ASOS told investors in a filing with the London Stock Exchange that users had received unauthorised notifications after a third-party platform used for customer communication was compromised. The stolen login was reportedly used to access information on certain third-party platforms ASOS relies on, and one of them could send messages to the app's entire customer base. The notification text claimed a fully compromised Snowflake instance and demanded engagement, or the data would be leaked. ASOS has not named the platform or confirmed the Snowflake claim.

A group calling itself Xuanye Group claimed responsibility on a newly created Telegram channel, and the notifications directed staff to engage with the group there. Forescout's Daniel dos Santos noted that the name suggests a Chinese-speaking actor but could be a false flag, and that the initial access method remains unconfirmed beyond ASOS's own account. The same Snowflake platform was the target of a 2024 campaign by ShinyHunters that hit more than 160 organisations, largely through credentials harvested by infostealers.

ASOS says the exposed data is limited to names, contact details and certain non-personal account information, and that payment card information and account passwords were not accessed. The company has not disclosed how many customers are affected. It locked down the affected platforms, brought in external specialists, law enforcement and regulators, and says its website and app remain safe to use. The pattern is a familiar one: the attacker did not need to defeat the retailer's core systems when a single trusted voice could be borrowed to open a door into the platforms around them.

The defences that failed here were not weak by conventional standards. ASOS had authentication, access controls and third-party platform governance, and it responded quickly once the notifications appeared. Every one of those controls answers the question "does this login belong to this person?" Once an attacker holds a valid credential obtained through a convincing impersonation, that question is answered yes, and the platform treats every action that follows as legitimate.

The control that was missing sits at the action, not the login. Sending a push notification to an entire customer base is an execution event. Before any employee or integration can broadcast a message through the app's communication platform, a confirmation request goes to the named authority on their registered device, and the action proceeds only with their biometric confirmation. The same applies to exporting customer data from a third-party platform, changing who can administer it, or issuing a new set of credentials. Each is a high-impact action, and each would stop at the boundary until the real authority confirmed it.

The attacker in this case held a stolen login and a convincing story. Neither produces a biometric confirmation on the real authority's registered device through a separate channel. If no confirmation arrives, the broadcast is blocked, the export does not run, and the customers never see the message. A trusted-contact impersonation, however convincing, cannot produce that confirmation. The execution boundary holds regardless of how credible the impersonation appears.

GoFirm is The Authority Platform. Stop unauthorised action. Every time.

In association with Osinto.ai, the collective intelligence and governance network for Security, Resilience & Defence teams.

References

1. Toulas, B. 2026. ASOS links data breach to social engineering attack, credential theft. BleepingComputer, 8 October 2026.
2. Arghire, I. 2026. ASOS confirms cyberattack, data breach. SecurityWeek, 7 October 2026.