Hackers posed as a trusted contact to trick an ASOS employee into handing over work login credentials. That familiar cover bypassed security checks faster than a software attack could. Social engineering means manipulating a person to grant access. In this case a valid login opened outside systems without triggering exploit defenses.
Table of Contents
- How the trusted-contact trick worked
- How shoppers saw the attack
- Whose information was exposed?
- What was ruled out
- What should customers do now?
How the trusted-contact trick worked
ASOS confirmed the attacker impersonated a trusted contact to steal an employee work account, as Infosecurity Magazine reported in its 8 Oct breach report. The method was credential theft through deception, not a software exploit. The stolen credentials then gave access to certain third-party platforms ASOS uses.
Those included customer-communication and notification systems. A real username and password look normal to many controls. That is why impersonation is efficient: one fooled person can replace extensive technical effort.
How shoppers saw the attack
Around 10am on 6 Oct 2026, the intruder used that third-party access to send an unauthorised push notification through the ASOS app itself, according to Help Net Security in its 7 Oct account of the incident. Delivery through the official app made the ransom message appear legitimate. The rogue alert was addressed to the data protection officer and IT team.
It claimed full compromise of a Snowflake data instance, demanded engagement, and linked to a Telegram channel tied to a group calling itself Xuanye Group. The public push turned a back-office account takeover into visible pressure. Shoppers became unwilling witnesses to a message meant for security staff.
Whose information was exposed?
The affected customers come from a large base of about 16.5 million active customers in more than 100 markets. Help Net Security described the exposed material as personal and customer-account data. That included names and contact details plus certain non-personal account information.
Such details do not permit direct purchases alone, but they enable convincing follow-on messages. Attackers can combine a name, contact history, and shopping context. That combination makes fake delivery, refund, or account emails harder to spot.
What was ruled out
ASOS said in its 8 Oct customer email that payment information was not compromised. Infosecurity Magazine reported that operations were unaffected and account passwords were not accessed in its summary of the ASOS email. That limits direct financial theft from this incident.
The remaining risk is fraud built on stolen identities. Snowflake also investigated after the push message claimed compromise of its instance. It told Infosecurity Magazine the issue did not result from any vulnerability, weakness, flaw, or misconfiguration, so no remediation was needed.
What should customers do now?
ASOS restricted access to the notification platform and continued investigating with internal and external specialists. The full data scope was therefore not final when the early reports were published. Customers should disregard the rogue push alert and avoid its external link:.
- Do not join the linked Telegram channel or contact the named group.
- Do not enter ASOS credentials from links in email or text messages.
- Watch for messages impersonating ASOS, delivery firms, or support staff.
You Might Also Like
- ASOS Data Breach: What Names and Contact Details Were Hacked?
- Burger King Japan Data Breach: 11.18 Million App Member Records Leaked
- ASOS Data Breach 2026: Hacked Push Alert, Customer Details and Searches Taken