ASOS Hacked: Thieves Stole Addresses and Sent the Alert Themselves
ASOS confirmed on Oct. 8 that hackers stole customer details and then used its own app to announce it.
The news, reported by TechCrunch, came after two days of shoppers reporting a strange push alert. In a London Stock Exchange filing, ASOS said hackers broke into an outside system it uses to contact customers London Stock Exchange.
Think of it like an outside mailing house. ASOS did not report a break-in to its main shopping system. The break-in was in a connected address book used for messages and tailored offers, which often sits outside the strictest controls.
The stolen data was names and contact details, according to the filing. That means home addresses, phone numbers and email addresses, plus notes linked to profiles such as website search queries. ASOS lists 17 million customers on its corporate site. The group behind the claim has not said how much ASOS data it allegedly holds.
The alert turned a quiet break-in into a public event. ASOS called it an "unauthorised customer notification" sent through its app. People posted screenshots online. It was addressed to ASOS's data protection officer and IT department and said the hackers had "fully compromised" ASOS data stored on Snowflake. It reads "Engage with us, or we will leak it." The hackers call themselves Xuanye Group.
The hackers got in by pretending to be someone trusted in order to steal a password, according to BleepingComputer. Snowflake said its own systems were not broken into. It was a trick played on one user, not a flaw in the platform itself.
App users raised the alarm before ASOS confirmed it. ASOS later confirmed the unauthorised message was sent through its app on Tuesday, Oct. 6 BBC. Earlier that day it said it was looking into unauthorised access after shoppers got messages saying its data was compromised.
ASOS shares fell after reports of the hack on Oct. 6, with one report putting the drop at 13% after the hacker push notification Reuters QZ.
The broader context here points to two problems meeting. In my view, message systems have become second copies of customer lists without the same protection. Trusted app alerts can then be hijacked to pressure victims directly.
In practical terms for shops and apps, the safety questions are small and clear. Which outside firms hold personal details, how long do they keep notes like search queries, how are passwords for data copies made and changed, and who can send a mass alert. Losing any one of those turns theft into direct pressure on customers.
Looking further ahead, stronger tools already exist. Scoped credentials, short-lived tokens, phishing-resistant logins for data platforms, and separate approval for mass messages all exist. The ASOS case is a reminder they must cover message systems and data copies, not only main databases.
