If you got a very strange push notification from the Asos app on Monday 6 October, you were not imagining it. It was not a flash sale. It was hackers.
Asos has confirmed that an unauthorised party got into some of its customer data after a social-engineering attack on an employee, and that the criminals then used the retailer’s own app notification system to announce themselves. The message was addressed to Asos’s data protection officer and IT department, claimed the company’s data had been “fully compromised”, and ended with a line straight out of a ransom note: “Engage with us, or we will leak it.”
Why we care: Asos has 17 million customers, according to its website, and a great many of them are women. This is what we know about what was taken, what wasn’t, and what to do about it.
What Asos Says Was Taken
Asos’s own list is deliberately narrow. In a security notification shared with BleepingComputer, the retailer said the data exposed covers full names, contact details and “certain non-personal account-related information”. Its website statement describes it as some “basic” personal information and contact details.
Crucially, Asos says the hackers did not access payment card information or account passwords. The company also told customers its website and app were, and remain, safe to use, and that it has locked down the affected platforms and brought in external experts, law enforcement and regulators.
Photo credit: BBC
Other outlets have reported a longer list. The BBC, says the stolen data includes home addresses, phone numbers and email addresses, plus notes on customer profiles such as website search queries. The Guardian reported that recent customer search histories were among the information accessed. Asos’s statement does not confirm addresses or search data, so treat those as reporting rather than the company’s own account.
What nobody has said is how many customers are affected. BleepingComputer asked Asos for a figure and had not received one; eSecurity Planet reported that the company had not disclosed a number. The hackers, for their part, have not said how much data they claim to hold.
How They Got In
This was not a sophisticated technical exploit. It was someone being convincing on the phone or in an inbox.
“We discovered that an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain log in credentials,” reads the Asos security notification shared with BleepingComputer. “Those credentials were then used to access information on certain third-party platforms used by ASOS.”
Which platforms? Asos has only said “third-party”. The hackers’ notification alleged they had compromised the company’s data hosted on Snowflake, the cloud data company, and TechCrunch reported the group broke into an Asos-run Snowflake instance. Asos has not confirmed that, and Snowflake told TechCrunch it had not experienced a breach of its own systems. TechCrunch also notes it is unclear whether the instance was protected with multi-factor authentication, and that it is not known how the hackers got into the system Asos uses to send in-app push notifications, which is often run by yet another third party.
The group behind it calls itself “Xuanye Group”. Its rogue notification urged Asos staff to engage with it on Telegram. Asos disclosed the incident in a filing with the London Stock Exchange.
What Asos Is Telling Customers
The official line is that you do not need to do anything to your account.
“There is no action you need to take on your account,” Asos says in its message to customers, “However, please remain cautious of unexpected messages or calls claiming to be from ASOS.” It adds: “We will never ask you to share passwords, security codes or payment details through an unsolicited message or call.”
The UK’s National Cyber Security Centre has published its own advice: be alert to suspicious communications, be wary of messages claiming to offer refunds, request account verification or demand urgent security action, and go directly to the official website or app rather than clicking through. Asos says it will contact customers directly if more information, support or action becomes necessary.
What To Actually Do Now
Asos is right that your card details and password were not, by its account, part of this. But names, emails and phone numbers are precisely what a scammer needs to write you a very believable text about a parcel, a refund or a “suspicious login”. Expect those.
Change your Asos password anyway. It costs you ninety seconds, and if you use the same one anywhere else, change it there too and stop doing that. Turn on two-factor authentication on your email account, because that is the one that unlocks everything else. Treat any message that mentions Asos and asks you to tap, confirm, verify or refund as hostile until proven otherwise, and if in doubt, open the app yourself rather than following a link. If the reported search-history bothers you, it is worth remembering that an attacker knowing you searched for a going-out top is embarrassing rather than dangerous; the contact details are the part that matters.
One more thing worth knowing: the person who got tricked here was an Asos employee, not a customer. Asos’s own account is that someone impersonated a trusted contact convincingly enough to be handed login details. The best defence is boring. Slow down, do not reply, and go to the source.
Asos says its investigation is ongoing and that it has already added further security measures. We will update this article if the company puts a number on how many customers were affected.
Some of the products and services featured in this article may be from our affiliate partners, which means we may earn a small commission if you make a purchase through these links — at no extra cost to you. Our editorial team only spotlights what we genuinely love and think you will, too.