ASOS: employee credentials stolen by impersonating a trusted contact, third-party platform data accessed, rogue app push notifications sent

What happened

• ASOS said an unauthorized party gained access to an employee account by “impersonating a trusted contact” to obtain login credentials, then accessed information on third-party platforms ASOS uses (TechCrunch: a platform hosting data used to communicate with customers): full names, contact details and some account information; no card data or passwords. On 6 Oct customers received push notifications through the ASOS app claiming a breach. Count not disclosed (ASOS has about 17 million customers).
• Root cause: social engineering and credential theft of an employee.
• “Xuanye Group” claimed it.
• Disclosed via the London Stock Exchange (TechCrunch); customers notified.

Sources

• https://www.bleepingcomputer.com/news/security/asos-links-data-breach-to-social-engineering-attack-credential-theft/
• https://techcrunch.com/2026/10/08/asos-confirms-breach-of-customer-data-after-hackers-send-rogue-app-notification/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.