Asos Confirms Customer Data Breach After Hackers Send Rogue App Notification

Hackers Exploit Third‑Party Platform to Threaten Leak of Personal Information

British fashion retailer Asos has acknowledged a breach that exposed personal details of its shoppers after cyber‑criminals infiltrated a third‑party service the company uses for customer communications. In a disclosure filed with the London Stock Exchange, Asos said the attackers accessed a platform that stores names, contact details and other profile notes, including home addresses, phone numbers, email addresses and website search queries.

The intruders sent an “unauthorised customer notification” through Asos’s own mobile app, a message that quickly appeared on social media. The note was addressed to Asos’s data protection officer and IT team, claiming the hackers had “fully compromised” the retailer’s data stored on Snowflake, a cloud analytics provider that lets corporate customers analyze large amounts of data. The warning read, “Engage with us, or we will leak it,” indicating the group’s intent to pressure the company into negotiations or risk public disclosure of the stolen information.

According to Bleeping Computer, the attackers gained entry to the retailer’s Snowflake instance by impersonating a trusted contact and obtaining login credentials. Snowflake has publicly stated that its own infrastructure was not breached, but it remains unclear whether the Asos‑managed environment was protected by multi‑factor authentication. Equally uncertain is how the hackers managed to trigger the in‑app push notification system, which is typically operated by an external service provider.

The group behind the attack identifies itself as Xuanye Group. While they have not disclosed the volume of data they claim to hold, Asos’s customer base totals 17 million individuals, according to the company’s website.

Precedent of Third‑Party Platform Abuse Highlighted by Earlier Breach

A similar scenario unfolded earlier this year at fintech firm Betterment. Hackers there exploited a third‑party marketing platform to impersonate the company, sending a cryptocurrency scam to customers and harvesting personal data such as names, email addresses and phone numbers.

Both incidents underscore the risk that third‑party services, which many firms rely on for communication and analytics, can become vectors for unauthorized access if security controls are insufficient.