ASOS says attackers took customers’ details, and a sample seen by the BBC includes the searches they ran on its site

ASOS, the online fashion retailer, says attackers took customer information after tricking one of its employees into giving up login credentials. A sample of the stolen data that the attackers gave to the BBC reportedly goes further than ASOS’s own description and includes the searches customers typed into the retailer’s website. The disclosure began on October 6, 2026, when customers received a push notification through the ASOS app announcing that the company had been hacked.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

What ASOS has confirmed: a tricked employee and third-party platforms

ASOS has been specific about the entry point but guarded about the contents. The attackers pushed a message to the app at around 10 a.m. on October 6 that ASOS called an unauthorised customer notification, and the retailer then spent hours without a full statement before emailing customers on Thursday, October 8. By that point the story had moved shares: ASOS stock rose as much as 5.7% that day, according to a report on the email. The group behind the intrusion calls itself the Xuanye group, a name reported by Malwarebytes from the Guardian’s coverage, and its app message was addressed to ASOS’s data protection officer and IT staff rather than to shoppers.

In that email, reported by Yahoo Finance, ASOS said an unauthorised party gained access to an employee account by impersonating a trusted contact, and that the resulting credentials were then used to reach information on third-party platforms the company uses. ASOS said the affected databases were locked down immediately, that a full investigation would continue over the coming weeks, and that it would contact anyone who needs additional support or action. TechCrunch adds that the confirmation came in a filing with the London Stock Exchange, in which ASOS named names and contact information as the data involved.

The search history in the BBC’s sample

ASOS’s own early wording was modest. In its first statement, relayed by Sky News and quoted in Malwarebytes’ earlier coverage, the retailer said “basic personal information including name and contact details may have been accessed.” The BBC’s reporting on the sample the attackers supplied paints a larger picture. According to Malwarebytes’ breach update, which attributes the list to the BBC rather than to ASOS, the sample included names and home addresses, phone numbers and email addresses, customer numbers and dates of birth, the date a customer started using ASOS, and the searches made on the site.

The searches are the unusual element, because they are behavior rather than identity. The examples reported from the sample were “reclaimed vintage,” “glamorous wide fit” and “Asos petite.” A search for a wide-fit shoe or a petite range can imply a body measurement, a style preference or a life event that a customer never typed into a profile, and a list of such queries attached to a real name, address and birth date is a richer profile than a mailing list. ASOS itself has not made a statement about searches, and the connection between the sample and the retailer’s description of “basic” data is a gap that outside reporting, not the company, has pointed out.

Payment cards and passwords: ASOS’s line

ASOS says payment card information and customer passwords were not accessed, and it says its website and app were safe to use throughout and remain so. Those are the company’s claims, which Malwarebytes reports without independent verification. The attackers’ own Telegram channel, as relayed in Malwarebytes’ earlier report on the rogue notification, likewise said payment information was not affected, but statements from an extortion group carry no weight as confirmation. ASOS has not said whether it will pay the ransom the attackers demanded, and the group reportedly gave the retailer two weeks to make contact.

Snowflake, Simon AI and the attackers’ claims

The attackers’ first message said they had fully compromised the Snowflake instance, addressing ASOS’s data protection officer and IT team and threatening to leak the data. They later told the BBC that the access ran through Simon AI, a personalization platform built on Snowflake that ASOS uses. Snowflake told Infosecurity, in coverage summarized by EM360Tech, that the incident was not caused by a vulnerability, weakness, flaw or misconfiguration in its service, platform or internal environments, and ASOS has not confirmed the Snowflake route. Stolen credentials can reach data without any flaw in the underlying platform, which is consistent with ASOS’s description.

Security researcher Kevin Beaumont, writing on Mastodon, said ASOS is experiencing the same public-relations mistakes as Co-op and M&S by not being honest with customers. ASOS has said customers need take no action on their accounts but should be wary of unexpected messages or calls claiming to be from the retailer, and that it will never ask for passwords, security codes or payment details through an unsolicited message or call.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.