The ASOS data breach that exposed some customers’ details began with an attack on a member of staff, the company has said.
In an update to customers on 8 October, the retailer said an unauthorised party had gained access to an employee’s account “by impersonating a trusted contact” to obtain their login details. Those credentials were then used to reach information on third-party platforms that ASOS uses to communicate with its customers.
What happened
The incident came to light on 6 October, when users of the ASOS app received push notifications claiming that customer data had been stolen. The messages, which appeared to be addressed to the company’s data protection officer and IT team, urged staff to make contact on the messaging service Telegram.
ASOS said it had locked down the affected platforms and opened an investigation with external experts and law enforcement. The Information Commissioner’s Office has been notified and is assessing the case, according to Bloomberg.
A group calling itself the Xuanye Group claimed responsibility. Researchers at Group-IB found that its Telegram channel was created on 6 October and that the account behind it had been used to trade online gaming items, with no known link to earlier attacks. The group also claimed to have compromised ASOS’s Snowflake data platform. Snowflake said the incident did not stem from any weakness in its service.
What the ASOS data breach exposed
ASOS said the data involved names, contact details and some account information, and that payment card details and account passwords were not accessed. A sample passed to the BBC appeared to include addresses, phone numbers and customers’ search terms, although it is not clear whether it has been independently verified.
The company has not said how many customers were affected. It told customers there was nothing they needed to do to their accounts, but asked them to be wary of unexpected messages or calls claiming to be from ASOS, and said it will never ask for passwords, security codes or payment details in an unsolicited message. Its shares fell sharply earlier in the week and regained some ground after the update.
A familiar pattern
The way in matters as much as the data. It is not the first attack on a UK retailer to begin with impersonation rather than malicious code: in 2025, Marks & Spencer’s chairman told MPs that its attackers had got in by impersonating a third party. Security software is good at stopping malware. It is far less able to stop a member of staff who has been persuaded, by someone who sounds legitimate, to hand over access.
How to protect your business
- Check any request for a login, a code or access through a contact you already have, never one given in the message or call itself.
- Use sign-in methods that can’t be read out over the phone, such as passkeys, and make sure staff know never to share a code, even with someone claiming to be IT.
- Give each account access only to what that person needs, so one stolen login can’t reach every system, including the third-party platforms you use.
At Universal Computing, our ongoing staff training programme runs simulated phishing tests, with online training for anyone who gets caught out and monthly reports so you can see where the risk sits. Our email protection and managed security software work underneath: they help stop phishing links, business email compromise and malware reaching your team, and keep continuous watch over your devices for anything suspicious.
To find out how your own team would handle an approach like this, book a free security review or read about our cybersecurity services.
