Cybersecurity
ASOS links breach to social engineering attack
ASOS said attackers obtained an employee’s login details by impersonating a trusted contact, then used them to reach information on third-party platforms and expose some customer data.
- ASOS said an unauthorised party gained access to an employee account after impersonating a trusted contact and obtaining login credentials.
- The company said those credentials were then used to access information on third-party platforms used by ASOS.
- ASOS said the exposed data included full names, contact details and certain non-personal account-related information, but not payment card details or account passwords.
- On 6 October 2026, customers received a push notification through the ASOS app, and the actor calling itself Xuanye Group said it had stolen customer data.
- ASOS said it had locked down the affected platforms and begun an investigation with external experts, law enforcement and regulatory authorities.
ASOS said a recent breach had begun when an attacker impersonated a trusted contact and obtained an employee’s login details. It said those credentials were then used to reach information on third-party platforms used by the company.
The company said it had secured the affected platforms and started an investigation with outside specialists, police and regulators. It also said its website and app remained safe to use.
On 6 October 2026, customers received a push alert through the ASOS app that referred to data theft and urged staff to contact the sender on Telegram. The sender identified itself as Xuanye Group and said it had taken customer data but not payment information.
ASOS later said the breach may have exposed basic personal information and contact details. It said the data did not include payment card information or account passwords, and that no action was needed on customer accounts.
Named in this story
Companies
- ASOS
- confirmed a breach and explained how access was obtained
Organisations
- Xuanye Group
- claimed to have stolen customer data and contacted ASOS staff
Products and systems
- ASOS app
- sent the push notification to customers on 6 October 2026
- Telegram
- was named as the channel the attacker urged staff to use
How the source tells it
The piece was a straightforward incident report, with no distinct emotive framing beyond attributed claims from the company and the attacker.
No emotive framing was found in the original.