ASOS confirms data breach after hackers hijack app to send "ASOS HACKED" alert

ASOS, the London-listed online fashion retailer, has confirmed a cybersecurity incident in which attackers gained access to a third-party platform connected to its mobile app and obtained personal information belonging to customers. The company says it does not believe payment-card data or account passwords were compromised.

How the breach started

Around 10:00 BST (05:00 ET) on 6 October 2026, ASOS app users began receiving an unauthorised push notification with the headline "ASOS HACKED", according to BleepingComputer and Help Net Security. ASOS quickly posted an in-app notice telling customers to disregard the alert and not to click any links in it.

ASOS said the intrusion began when an attacker impersonated a trusted contact to trick an employee into handing over login credentials, according to Infosecurity Magazine and TechCrunch. Those credentials were then used to reach third-party platforms ASOS relies on to communicate with customers, including the system used to send app push notifications.

According to Infosecurity Magazine, malware researcher Pieter Arntz suggested that Simon AI, a marketing platform used by ASOS and built on Snowflake's Cortex AI, may be indirectly linked to the incident, though this has not been confirmed as the way attackers gained access. Snowflake said the issue did not result from any vulnerability or misconfiguration on its own platform and that its other customers did not need to take any action, Infosecurity Magazine reported.

What data was exposed

In its first statements, ASOS said the exposed information was limited to basic contact details. According to SecurityWeek, ASOS confirmed the breach in a statement filed with the London Stock Exchange on 7 October 2026.

The hackers later gave reporters a sample of the data they claim to hold. According to Infosecurity Magazine and Malwarebytes, that sample included customer names, home addresses, phone numbers, email addresses, customer account numbers, dates of birth, account creation dates, and records of searches customers had made on the ASOS website, with examples such as "reclaimed vintage" and "ASOS petite".

Who is behind the attack

A group identifying itself as Xuanye Group claimed responsibility, operating from a newly created Telegram channel, according to SecurityWeek and TechCrunch. In a message addressed to ASOS's data protection officer and IT team, the group claimed to have compromised the company's Snowflake instance and warned, "Engage with us, or we will leak it," according to SecurityWeek and TechCrunch.

Infosecurity Magazine reported that researchers traced the Telegram account linked to the group, which had previously used names including "JohnCZ" and "Moon Transfers" in connection with online gaming item trading, though this earlier activity has not been formally tied to the ASOS intrusion.

Scale and what remains unknown

ASOS has roughly 17 million customers, TechCrunch reported, but the company has not disclosed how many individual accounts were affected by the breach. ASOS said it restricted access to the affected notification platforms and is working with internal and external security specialists, according to SecurityWeek.

The incident has drawn attention to the risks of third-party, customer-facing software used by retailers to send marketing and app messages, since such systems can carry broad access to customer records while sitting outside a company's core infrastructure.

Advice for customers

• According to Malwarebytes, customers should treat unexpected emails, texts or app messages referencing the breach with caution, and should not click links in them.
• Malwarebytes advised accessing ASOS only through the official app or website rather than through links sent in messages.
• Malwarebytes advised never sharing a password or a one-time security code with anyone who contacts you.
• Malwarebytes advised watching for phishing attempts that use leaked details such as your name or address to appear convincing.