Hackers stole ASOS employee credentials to access third-party platforms

UK fashion giant ASOS said a data security incident earlier this month stemmed from a social engineering attack, in which hackers stole an employee’s credentials to access information on third-party platforms used by the company.

Earlier this month, several customers of online fashion and cosmetics retailer ASOS reported receiving a push notification claiming the company’s internal network had been breached. The message, titled “ASOS HACKED,” was addressed to the company’s data protection officer and IT team.

“Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it,” reads the notification.

Commenting on reports of a network breach, ASOS said an unauthorised customer notification was sent around 10am, prompting an immediate internal investigation. While the retailer initially reported no compromise of its Snowflake platform, it later confirmed that basic personal information, including names and details, may have been accessed during the incident.

“We do not believe that payment-card information or account passwords were impacted,” a company spokesperson said.

In a subsequent update , ASOS revealed that its investigation found the attackers had employed social engineering tactics to steal an employee’s login credentials, which they then used to access data on third-party platforms utilised by the retailer.

“We discovered that an unauthorised party gained access to an ASOS employee account by impersonating a trusted to obtain login credentials. Those credentials were then used to access information on certain third-party platforms used by ASOS,” ASOS said.

The company added that it immediately secured the affected platforms to prevent any further unauthorised access to information. The retailer also confirmed that its website and app were unaffected by the incident and remained safe for customers to use throughout.

A group of cyber criminals using the alias Xuanye Group claimed responsibility for the ASOS breach and shared a link to a Telegram account stating that payment information was not affected.

Please take 30 seconds to register

Already have an account? Sign in

"AI-led spear phishing worries me the most" - Darktrace's Dave Palmer

"Crisis or no crisis; security needs to be the same"

"People need to understand that there isn't an invisible force-field that's protecting them"

"The community needs to recognise and understand crime"

"We've seen a marked increase in social engineering attacks"

"AI-led spear phishing worries me the most" - Darktrace's Dave Palmer

"Crisis or no crisis; security needs to be the same"

"People need to understand that there isn't an invisible force-field that's protecting them"

"The community needs to recognise and understand crime"

"We've seen a marked increase in social engineering attacks"

$12M Vanishes in Crypto Heist Targeting Cork Protocol’s Depeg Market

$600 million stolen & returned in biggest ever crypto heist

10-month cyber attack exposes personal data of South Korean diplomats

Closing the exposure window — unifying continuous threat exposure management

Trusting your AI agents

The blind spots in your stack - why fragmented data security fails

Winston House, 3rd Floor, Units 306-309, 2-4 Dollis park, London, N3 1HF