ASOS confirms customer data breach following targeted social engineering attack
Global online fashion retailer ASOS has confirmed a cybersecurity incident that exposed customer personal data after threat actors compromised an employee account through a targeted social engineering scheme. The breach came to light after attackers hijacked official communication channels to push rogue mobile app notifications directly to users, directing them to an external Telegram channel.
While ASOS confirmed that sensitive financial records and account passkeys remained secure, the incident highlights persistent supply chain and third-party platform security risks across large e-commerce platforms.
Compromise Mechanics and Extent of Exposed Data
According to a security notice issued by the UK-based retailer, an attacker impersonated a trusted contact to deceive an employee into surrendering network authentication credentials. The threat actor then used these stolen credentials to move laterally into integrated third-party service provider databases used by ASOS for customer communications and operational analytics.
Subsequent forensic disclosures confirmed that the compromised datasets include:
Contact & Delivery Details: Customer full names, email addresses, phone numbers, and physical delivery locations.
Behavioral Records: Recent user search queries, product browsing histories, and non-personal account metadata.
Financial data, including credit card numbers, payment processing details, and account passwords, was isolated and not accessed during the intrusion.
Direct Communication Hijack and Threat Actor Attribution
The breach escalated publicly when the threat actor, self-identifying as the "Xuanye Group," sent rogue push notifications directly through the ASOS mobile app. The messages contained links to a public Telegram channel where the group broadcast claims of the data exfiltration to pressure company leadership.
Threat intelligence analysts noted that using legitimate customer notification channels directly to announce an intrusion represents an aggressive tactic aimed at maximizing brand reputation damage and force ransom discussions.
Containment Measures and Regulatory Compliance
Upon discovering the unauthorized access, ASOS revoked the compromised employee credentials, isolated the impacted third-party environments, and deployed external incident response specialists to contain the breach.
The retailer notified the UK Information Commissioner’s Office (ICO), law enforcement authorities, and affected international data protection regulators in accordance with statutory requirements. ASOS has since implemented stricter multi-factor authentication controls, enhanced third-party access monitoring, and advised customers to remain vigilant against follow-on phishing attempts leveraging stolen contact details.
