“ASOS HACKED”: One Impersonation, One Stolen Login, and an Online Retailer’s Own App Turned Against Its Customers
Updated: 4 days ago
It only takes one convincing phone call, message or email to hand an attacker the keys. On 6
October, ASOS learned that lesson in front of millions of customers.
The ASOS Attack Timeline
The Hook: Attackers impersonated a trusted contact to obtain an ASOS employee’s login
credentials [1].
The Action: Those credentials unlocked third-party platforms ASOS uses to communicate
with customers [1][3]. The attackers told the BBC they got in through Simon AI, a marketing platform built on Snowflake [2][4]. That is their claim, and neither ASOS nor independent researchers have confirmed it [6].
The Payload: At around 10am, a push notification from the genuine ASOS app announced a compromise, addressed to ASOS’s DPO and IT team, and demanded they “engage with us, or we will leak it” [3].
The Outcome
Stolen data includes names, addresses, phone numbers, emails, customer numbers, dates of birth and website search histories [2]. ASOS says no payment card details or passwords were accessed [1].
The company first described the exposure as basic information, then widened its account once the hackers sent the BBC a data sample [2]. It hasn’t said how many of its roughly 16–17 million active customers are affected [3][6]. Shares fell more than 14% intraday and closed down 9.56% [8]. ASOS says customers need take no action, but they should expect convincing phishing built from their real details [1].
What Likely Went Wrong
Based on what has been made public, we assess this as an identity failure rather than a technical exploit. ASOS says one employee was socially engineered, and the attackers’ own account points to a vendor platform that accepted a stolen login. We have high confidence in that part. Snowflake says its platform was not compromised [4], and the Snowflake-linked breaches of 2024 came from stolen credentials on accounts without MFA [5], so we would expect missing or bypassable MFA to be a factor. That is inference, not confirmed fact.
With medium confidence, permissions were too broad. One account could read rich customer
profiles and also broadcast to the entire app base. With lower confidence, detection and response were slow: customers heard from the attackers first, and the Independent reported around fivenhours before ASOS’s full statement [7]. These remain assessments until ASOS publishes a post-incident review.
Our Take
This is not a story about one careless employee. Convincing impersonation will eventually work on someone, so resilient organisations design for it. The pattern is a familiar one: businesses harden their own network, then trust a chain of SaaS tools with their most valuable data and generous permissions.
The fix is layered. Verification steps for unusual requests, phishing-resistant MFA that can’t be talked out of a user, and permissions that limit what any single account can do turn a successful trick into a contained incident instead of a headline. A rehearsed incident response plan matters just as much, including who approves the first public statement. No business can be made invulnerable, but every business can be made far harder to breach and far quicker to recover.
What to Do This Week
➡ Audit your third-party platforms. List every tool that holds customer data or can message
customers, and check who has access and whether MFA is enforced.
➡ Upgrade to phishing-resistant MFA (passkeys or hardware keys) for admin and vendor accounts.
➡ Add a second approver to any bulk customer communication.
➡ Rehearse your breach response, including customer messaging, before you need it.
Sources
[1] ASOS Customer Care, Latest information about the unauthorised ASOS notification
[2] BBC News, Asos hackers took more personal details than first revealed
Comments