ASOS breach began with an employee tricked out of their login
ASOS says an attacker impersonated a trusted contact to get an employee's login credentials, then used them to reach customer names and contact details on third-party data platforms. Snowflake says nothing on its side was at fault. The number of affected customers is undisclosed.
UK online fashion retailer ASOS said on October 8 that an unauthorized party got into an employee account by "impersonating a trusted contact to obtain log in credentials," then used those credentials to access information on certain third-party platforms the company uses. ASOS says customer names, contact details and some non-personal account information may have been exposed, but not payment card data or account passwords. It locked down the affected platforms and is working with external investigators, law enforcement and regulators. The incident surfaced on October 6, when ASOS app users received rogue push notifications from a group calling itself "Xuanye" that referred to Snowflake. A Snowflake spokeswoman said the issue did not result from any vulnerability, weakness, flaw or misconfiguration in its service. ASOS has not said how many customers are affected.
Why it matters
The failure here is identity verification of a person, not a platform bug. One phished employee login was enough to reach customer data held in SaaS platforms, which points at two controls: phishing-resistant MFA on every account that can query customer data, and a call-back or out-of-band check before anyone acts on a "trusted contact" request. The help desk social engineering brief covers the verification side, and the Scattered Spider teardown shows the same pattern at retail scale.
It also echoes the 2024 Snowflake customer attacks: the data platform holds, but valid credentials walk straight in. Check which third-party data platforms accept password-only or SMS-based sign-in, and whether network policies limit where those sessions can come from.
Source: BleepingComputer, Snowflake statement via Capital FM
Related on Start with Identity
- BlogFBI removes contractor after a missed patch led to the ShinyHunters breach of employee data
The FBI says a contractor failed to apply a patch to a third-party-managed platform, opening the way for the ShinyHunters breach of employee records. Reuters na
- BlogDexcom says targeted vishing calls led to access to internal documents
Glucose monitor maker Dexcom says targeted voice phishing gave an unauthorized party access to limited information in certain internal documents. It reports no
- BlogAttackers are phoning employees about their passkeys, then enrolling their own MFA method
Microsoft detailed a campaign running since May 2026 in which callers posing as IT tell US enterprise users to update their passkey or MFA settings, route them
- RecipeAdd login to a Next.js app with OIDC
A complete, copy-paste OpenID Connect login for the Next.js App Router using authorization code flow with PKCE, server-side token exchange, and httpOnly cookies
- ArticleCIAM Journey Orchestration Explained: No-Code Auth Flows and Their Limits
Identity orchestration lets teams design login, signup, verification, and step-up journeys as configurable flows instead of hard-coded logic. This guide explain
- ArticleHeadless CIAM and API-First Authentication: When to Own the Login UX
Headless CIAM gives you identity as APIs and SDKs while you build every login screen yourself. This guide explains what headless means, when owning the UX pays