ASOS, the London-based online fashion merchant, has attributed its recent data breach to a social engineering campaign that resulted in the theft of an employee's login credentials. The attackers subsequently used those credentials to gain entry to third-party platforms integrated with ASOS's operations.
We discovered that an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain log in credentials. Those credentials were then used to access information on certain third-party platforms used by ASOS.
ASOS security notification
Following discovery of the breach, ASOS secured the compromised platforms and initiated a formal investigation with assistance from external security specialists, law enforcement agencies, and regulatory bodies.
On October 6, 2026, ASOS app users received a push notification alerting them to potential data theft and directing staff to communicate via Telegram. A group identifying itself as "Xuanye Group" claimed responsibility for stealing customer information, though they stated that payment data remained uncompromised.
ASOS subsequently confirmed through a website statement that the incident exposed certain "basic" personal information and contact details. The company has now specified the scope of exposed data:
- Full names
- Contact details
- Certain non-personal account-related information
The retailer emphasized that payment card information and account passwords were not accessed during the breach. ASOS maintains that its website and mobile application remained secure throughout the incident and continue to be safe for customer use.
There is no action you need to take on your account. However, please remain cautious of unexpected messages or calls claiming to be from ASOS. We will never ask you to share passwords, security codes or payment details through an unsolicited message or call.
ASOS customer advisory
ASOS indicated that its investigation remains ongoing and will publish additional findings if material developments occur. The company has already deployed supplementary security controls designed to mitigate the risk of comparable incidents. The total number of affected customers has not yet been disclosed by ASOS.