ASOS Blames Data Breach on Social Engineering and Stolen Credentials

ASOS, the UK-based online retailer that sells clothing, footwear, accessories, and beauty products to customers worldwide, has shared details about its recent security incident. According to the company, the breach was the result of a social engineering attack.

"We discovered that an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain log in credentials," reads a security notification the company shared with BleepingComputer. Those credentials were then used to access information on certain third-party platforms used by ASOS.

After spotting the problem, the company locked down the affected platforms and launched an investigation with support from external experts, law enforcement, and regulatory authorities.

How it started

On October 6, 2026, ASOS customers received push notifications through the retailer's mobile app. The messages alleged that customer data had been stolen and urged the company's staff to engage with the attackers on Telegram. A group calling itself "Xuanye Group" claimed to have stolen customer data, though not payment information.

ASOS eventually confirmed the breach in a statement on its website, acknowledging that some "basic" personal information and contact details may have been exposed.

What was exposed

According to the company's latest update, the exposed details include full names, contact details, and certain non-personal account-related information. ASOS says that payment card data and account passwords were not accessed.

The retailer stresses that its website and app were, and remain, completely safe to use. "There is no action you need to take on your account," it tells customers. At the same time, ASOS urges people to stay cautious of unexpected messages or calls claiming to be from the company, noting that it will never ask for passwords, security codes, or payment details through an unsolicited message or call.

The investigation is still underway, and ASOS has promised further updates if important findings emerge. The company also says it has already implemented additional security measures to prevent similar incidents. BleepingComputer asked ASOS how many customers were affected, but has not yet received a figure.

Source: Bleeping Computer