ASOS customer data reached with an employee login obtained by impersonation
On October 6, 2026 ASOS app users received rogue push notifications from a group calling itself Xuanye that referred to Snowflake. ASOS said on October 8 that an unauthorized party impersonated a trusted contact to obtain an employee's login credentials and used them to access customer names, contact details and some non-personal account information on certain third-party platforms. Snowflake said the incident did not result from any flaw in its service.
- Victim
- ASOS
- Industry
- Retail and e-commerce
- Country
- United Kingdom
- Intrusion began
- Not disclosed
- First disclosed
- Oct 6, 2026
- Actor
- Xuanye (claimed) (Unattributed)
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
An impersonated contact obtained a working login to customer data platforms. Phishing-resistant MFA on any account that can query customer data, and out-of-band verification of credential requests, are the controls.
Sources
- Asos confirms breach of customer data after hackers send rogue app notification, TechCrunch, Oct 8, 2026
- ASOS links data breach to social engineering attack, credential theft, BleepingComputer, Oct 8, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- DoorDash user contact data taken after an employee was socially engineered 2025 · Credential phishing
- Dexcom internal documents accessed after targeted vishing 2026 · Credential phishing
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
- Mixpanel smishing breach exposes OpenAI API user data 2025 · Credential phishing
Cite this record
SWI Community Team. (2026). ASOS customer data reached with an employee login obtained by impersonation. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-asos-employee-credential-theft/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.