ASOS customers were told they had been hacked by the retailer's own app, and the login behind it was just a phone-call away

By Pippa - Published: 11 October 2026

On Tuesday thousands of ASOS customers got a push notification from the ASOS app telling them the company had been hacked. It looked like a prank, and in a sense the app did what it was built to do: deliver a message the brand had authorised. The difference is that nobody at ASOS had written it. The retailer has since told customers that someone reached an employee account by impersonating a trusted contact, then used those credentials to get into third-party platforms the business relies on.

What is known, and what is only claimed

ASOS says the incident happened on 6 October, that payment details and passwords were not affected and that trading carried on. It first described the exposed data as basic contact details. The BBC, according to Infosecurity Magazine, saw a sample that held more, including phone numbers, customer numbers and website search terms; whether that sample has been independently checked is not stated. The person behind it, using the name Xuanyewen, says a Snowflake instance was compromised. Malwarebytes points out that the notification proves misuse of the messaging channel but not, on its own, that a data store was emptied. Snowflake says it found no compromise of its platform and no flaw or misconfiguration behind the incident. A suggested link to Simon AI, a marketing platform built on Snowflake that ASOS is reported to use, is unconfirmed. ASOS has not published a customer count; it serves around 17 million people.

The channel is the story

Most breach write-ups stop at the data. The more interesting part here is that the attacker obtained a way to speak to customers in the company's own voice. That is a different kind of asset from a database, and it tends to sit in a different team's hands: marketing owns the campaign tool, security owns the identity provider, and the integration between the two belongs to whoever set it up in 2023. A well-built phishing message sent from a genuine push channel will outperform any lookalike domain, because every check a customer has been trained to make comes back clean.

There is also a quieter lesson in the way the credentials were obtained. Nobody exploited a vulnerability. Someone was persuaded, and the damage came from what that person's login could reach. The same pattern sat behind the Nikkei email account compromises disclosed the same week.

Questions worth asking on Monday

• Who can send a push notification, an SMS or a marketing email to all customers, and is that action protected by something stronger than a password?
• Does a single employee login reach your customer data platforms, or are analytics and messaging tools behind separate, scoped service accounts?
• Can the help desk, a supplier or an agency reset access on a phone call, and what proof do they ask for?
• If a mass message went out that you did not approve, who can switch the channel off at night, and how long would it take to find them?
• Is there a pre-agreed holding statement for customers for the case where the first they hear of a breach is from the attacker?

None of that is exotic. It is a short list that tends to get skipped because the tools involved feel like marketing furniture. If you would like a second pair of eyes on the connections between your customer tools and your identity provider, write to sales@halfteck.com.