Global online fashion retailer ASOS has confirmed that hackers accessed customer information after impersonating a trusted contact to obtain an employee’s login credentials, allowing them to gain access to third-party platforms used by the business.
The breach came to light on 6 October when ASOS customers received an unauthorised push notification through the retailer’s mobile app, claiming its systems had been compromised and directing users to a Telegram channel linked to a group calling itself Xuanye Group.
Following an investigation involving internal and external cybersecurity experts, ASOS confirmed that the attackers had accessed personal information, including customer names and contact details, alongside certain non-personal account information.
The company said no payment card information or account passwords had been accessed, and that its website and app remained safe to use throughout the incident.
ASOS immediately restricted access to the affected third-party platforms and is working with law enforcement and regulatory authorities as its investigation continues.
The retailer has advised customers to remain alert to suspicious messages or calls claiming to be from ASOS, particularly those requesting passwords, security codes or payment information.
The incident highlights the cybersecurity risks facing online retailers, particularly where employee credentials and third-party technology platforms provide access to customer information.
ASOS said its investigation would continue over the coming weeks, with affected customers to be contacted directly if further information or action is required. The company has also introduced additional security measures following the incident.
