ASOS Links Data Breach to Credential Theft and Social Engineering
UK online fashion retailer ASOS has confirmed that a cybersecurity incident earlier this week was caused by a social engineering attack that compromised an employee's login credentials, leading to unauthorized access on third-party platforms.
Radwan AbdulhadiEditor and technology writer
Incident Overview and Attack Vector
UK fashion retailer ASOS confirmed that a recent data breach was caused by a social engineering attack in which hackers stole an employee’s login credentials. These stolen credentials were subsequently used to access information on third-party platforms utilized by the company.
According to an ASOS security notification shared with BleepingComputer, the unauthorized party gained access to an employee account by impersonating a trusted contact to obtain login credentials. In response to the breach, the company locked down the affected platforms and launched an investigation with the support of external experts, law enforcement, and regulatory authorities.
In-App Notifications and Threat Actor Claims
The security incident drew widespread attention when ASOS customers received a push notification through the official mobile application. This development was closely tracked and initially reported by outlets covering the event.
On October 6, 2026, mobile users received notifications alleging customer data theft and urging staff to engage with the threat actors on Telegram. A threat actor group calling themselves “Xuanye Group” claimed responsibility for the incident, asserting that they had stolen customer data while maintaining that payment information was untouched. ASOS later published a statement on its website confirming the breach, which may have exposed basic personal information and contact details.
Impact on Customer Data and Payment Security
The latest updates sent by ASOS to affected customers clarify the exact scope of the compromised information. The exposed details consist of certain non-personal account-related information.
ASOS strongly assured users that hackers did not access payment card information or account passwords. Furthermore, the retail giant stated that its official website and mobile application remained safe to use throughout the incident and continue to be secure.
Company Guidance and Ongoing Investigation
In its communications with consumers, ASOS advised that no immediate action is required regarding individual accounts. However, the company urged users to remain cautious of unexpected messages or calls claiming to represent ASOS.
The retailer emphasized that it will never ask users to share passwords, security codes, or payment details through unsolicited messages or phone calls. ASOS noted that its internal investigation remains active and promised to share further updates should significant findings emerge. Additionally, the company has taken proactive steps to implement supplementary security measures designed to prevent similar incidents in the future.
Sources
- BleepingComputerASOS links data breach to social engineering attack, credential theft
Continue chronologically
Related stories
ASOS Confirms Cyberattack After Rogue In-App Notifications
British online retailer ASOS confirms a data breach following unauthorized push notifications sent to users via a compromised third-party platform.
Capcom Confirms Massive Data Breach Affecting 11.7 Million Users
Capcom has confirmed a data breach affecting over 11.7 million Capcom ID accounts, exposing customer email addresses and related account information.
Nikkei Discloses Third Data Breach in a Month
Japanese media giant Nikkei Inc. discloses its third data breach in a month, exposing 1.83 million personal records via a compromised development system.
Oracle Health Data Breach Impact Climbs to Nearly 20 Million
A report reveals that the cyberattack on Oracle Health's legacy Cerner systems has compromised the personal and medical data of nearly 20 million people.
