# ASOS breach began with an employee tricked out of their login

Source: https://startwithidentity.com/blog/2026-10-08-asos-breach-began-with-an-employee-tricked-out-of-their-login/
Last updated: 2026-10-08
License: content by Start with Identity. Cite the source URL.

---

UK online fashion retailer ASOS said on October 8 that an unauthorized party got into an employee account by "impersonating a trusted contact to obtain log in credentials," then used those credentials to access information on certain third-party platforms the company uses. ASOS says customer names, contact details and some non-personal account information may have been exposed, but not payment card data or account passwords. It locked down the affected platforms and is working with external investigators, law enforcement and regulators. The incident surfaced on October 6, when ASOS app users received rogue push notifications from a group calling itself "Xuanye" that referred to Snowflake. A Snowflake spokeswoman said the issue did not result from any vulnerability, weakness, flaw or misconfiguration in its service. ASOS has not said how many customers are affected.

## Why it matters

The failure here is identity verification of a person, not a platform bug. One phished employee login was enough to reach customer data held in SaaS platforms, which points at two controls: [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) on every account that can query customer data, and a call-back or out-of-band check before anyone acts on a "trusted contact" request. The [help desk social engineering](https://startwithidentity.com/techniques/help-desk-social-engineering/) brief covers the verification side, and the [Scattered Spider teardown](https://startwithidentity.com/breaches/scattered-spider-helpdesk-social-engineering/) shows the same pattern at retail scale.

It also echoes the [2024 Snowflake customer attacks](https://startwithidentity.com/breaches/snowflake-2024-credential-attacks/): the data platform holds, but valid credentials walk straight in. Check which third-party data platforms accept password-only or SMS-based sign-in, and whether network policies limit where those sessions can come from.

Source: [BleepingComputer](https://www.bleepingcomputer.com/news/security/asos-links-data-breach-to-social-engineering-attack-credential-theft/), Snowflake statement via [Capital FM](https://www.capitalfm.com/radio/news/uk-world/snowflake-firm-in-asos-hacking-message-issues/)