ASOS confirms customer data theft after attackers hijack its app notifications
ASOS confirmed on Oct. 8 that attackers stole customer personal data and then used its own app to tell customers about it.
The disclosure, reported by TechCrunch, followed two days of user reports about a rogue push notification. In a London Stock Exchange filing, ASOS said hackers broke into a third-party platform hosting data ASOS uses to communicate with customers London Stock Exchange.
That platform is the crux for enterprise teams. ASOS did not describe a breach of its core commerce stack. It described compromise of an adjacent communications data store, the kind of system that tends to accumulate production customer records for messaging, segmentation and personalization while sitting outside the tightest access controls.
The data taken was names and contact information, according to the filing. The detailed set includes home addresses, phone numbers and email addresses, as well as notes relating to customer profiles such as website search queries. ASOS lists 17 million customers on its corporate site. The group behind the claim has not indicated how much ASOS data it allegedly possesses.
The notification itself turned a quiet intrusion into a public incident. ASOS called it an "unauthorised customer notification" sent through its app. Recipients posted screenshots to social media. It was addressed to ASOS's data protection officer and IT department and stated the hackers had "fully compromised" ASOS data hosted on Snowflake. It reads "Engage with us, or we will leak it."
The hackers identify themselves under the handle Xuanye Group.
How access was obtained matters more than where the data sat. The attackers broke into the Snowflake instance by impersonating a trusted contact to obtain login credentials, according to BleepingComputer. Snowflake said it had not experienced a breach of its systems. That distinction matters. This was credential theft via social engineering against a tenant, not an exploit of the data platform.
The timeline moved quickly. App users raised the alarm about the rogue notifications before ASOS confirmed them. ASOS later confirmed its unauthorised customer notification was sent via its app on Tuesday, Oct. 6 BBC. Earlier that day the company said it was investigating unauthorised access to its app system after shoppers received notifications claiming its data was compromised.
Markets reacted before the full confirmation. ASOS shares fell after reports of the hack on Oct. 6, with one report putting the drop at 13% after the hacker push notification Reuters QZ.
The broader context here is worth spelling out. In this author's view, two patterns are converging. First, customer engagement infrastructure has become a shadow customer database, replicated from systems of record and rarely treated with the same rigor. Second, push and in-app messaging has become a trusted channel that attackers can repurpose for extortion, reaching victims directly without needing to go through the press or a leak site.
Worth flagging for practitioners: the defensive questions are narrow. Which third parties hold routable PII, how long do they retain behavioral notes like search queries, how are service credentials for analytics instances issued and rotated, and who can publish to the customer notification path. Compromise of any one of those turns a data theft case into a direct-to-user pressure campaign.
The long arc still favors better tooling. Scoped credentials, short-lived tokens, phishing-resistant authentication for data platforms, and separate approval for broadcast messaging all exist. The ASOS case is a reminder that they need to cover comms platforms and analytics copies, not only production databases.
