Asos Data Breach Widens to Birth Dates and Shopping Searches

From "basic contact details" to customer profiles

In two days, Asos went from describing a limited exposure of customer data to admitting a much broader one. On Tuesday 6 October, the UK online fashion retailer told the London Stock Exchange that an "unauthorised third party" had sent a pop-up notification through its app. At that point it said only that "basic personal information including name and contact details may have been accessed."11 By Thursday, Asos was telling customers that criminals hold detailed profiles of potentially millions of users. Those profiles include names, addresses, phone numbers, emails, customer numbers and dates of birth.11

The new disclosure was not voluntary. Asos sent its update after BBC News told the company that cyber criminals had contacted the broadcaster to say the breach went well beyond basic contact details. The sample the attackers gave the BBC also contained customers' on-site searches, with terms like "reclaimed vintage", "glamorous wide fit" and "Asos petite". The data even showed how long people had been customers.1116 One customer, Harriet, told the BBC it was "very unsettling" that the hackers knew she had been shopping with Asos since 2019.11

Asos's own email to customers was less specific than the BBC's reporting. The company confirmed that names and contact details were taken, along with what it called "certain non-personal account-related information."18 It did not explain that phrase. Several outlets understand it to mean customers' search histories.219 Calling search data "non-personal" is generous. A record of what a named person searched for, tied to their home address and date of birth, is about as personal as retail data gets.

How the attack unfolded

The breach became public in an unusual way. At around 10:00 BST on Tuesday, Asos app users received a notification headed "ASOS HACKED". It was addressed to the company's data protection officer and IT team: "we have fully compromised the Snowflake instance. Engage with us, or we will leak it". It also included a link to a Telegram channel.1317 Many recipients thought it was a marketing gimmick. One Edinburgh analyst told the BBC she first assumed it was a flash-sale promotion.17 Check Point's Charlotte Wilson called it a "brazen" attack that had turned Asos's own app into a ransom note.17

After what it described as a 48-hour investigation, Asos said the root cause was social engineering, not a technical exploit. An attacker had impersonated "a trusted contact" to get an employee's login credentials, then used them to reach information on third-party platforms the retailer uses.24 Asos says those platforms were locked down straight away and that it is working with law enforcement and regulators.2

The attackers, calling themselves Xuanyewen or the Xuanye Group, told the BBC they got the data through Simon AI. Simon AI is a customer-personalisation platform built on Snowflake that Asos uses.1116 Malwarebytes researcher Pieter Arntz had already pointed to that marketing setup on Tuesday. He warned that any exposure could reveal browsing and buying habits, location and loyalty status.3 Thursday's disclosures largely confirmed his warning.

No zero-day, and no platform flaw

For security teams, the most important point is what this breach was not. There is no evidence of a zero-day vulnerability, an unpatched server or a flaw in a cloud provider's code. Snowflake said the incident "did not in any way result from a vulnerability, weakness, flaw, or misconfiguration" in its service, platform or internal environments.10 Malwarebytes reached the same conclusion: using stolen credentials to get into a customer's account on a connected service does not mean the underlying platform was breached. Nothing reported so far shows a vulnerability in Snowflake or Simon AI.7 One analysis of the timeline put it simply: the weak point was human trust, not a patched or unpatched server.9

That makes this a familiar kind of incident. It is about identity security, not patching. TechCrunch noted that it is still unclear whether Asos's Snowflake instance was protected by multi-factor authentication.1 That is the most important open question for defenders. A single phished login should not be enough to download a customer database. If it was, the problem is access control, not software.

A second unanswered question may matter just as much. Dan Bird of Horizon3 said that sending a push notification requires access to Asos's notification system, which is separate from the data platform. If both claims are true, the attackers had credentials that "opened more than one door."17 One technical write-up suggested that API keys or OAuth tokens linking a customer data platform to a push provider would be enough to take over a brand's messaging channel.6 That is analysis, not confirmed fact. Still, the fact that the attackers could both download data and send push notifications suggests their access went well beyond one database.

An extortion playbook without encryption

This is extortion without ransomware. No systems were encrypted, and Asos says its website and app stayed safe to use throughout.11 The pressure came from publicity. The attackers made the breach visible to millions of customers and set a deadline. Malwarebytes reports that the group gave Asos two weeks to make contact and wants a ransom in exchange for deleting the data. Asos has not said whether it will pay.7 The group's Telegram channel said the data was "safe on our server" and would not be touched for a "designated period".13

The group behind it is new. Group-IB's Anastasia Tikhonova called Xuanyewen "a newly surfaced name". She noted that its Telegram channel was created the day the message went out, which shows when the group became visible, not when it got in. BBC Verify found that the channel names used spellings consistent with Chinese pinyin and that the messages appeared to be translated from Chinese. The BBC said it could not confirm the group's claims.13 One threat-intelligence write-up cites KELA research linking an account tied to the extortion attempt to a September effort to buy $100,000 of Roblox and Counter-Strike items.6 That claim has not been widely reported elsewhere, and it should be treated as preliminary.

The tactic of hijacking a company's customer channel has been seen before. TechCrunch pointed to Betterment, the fintech firm whose third-party marketing platform was abused earlier this year to send customers a crypto scam.1 Abusing trusted channels like this appears to be becoming a pattern.

Where the reporting diverges

The coverage agrees on the basic facts but differs on several details. Estimates of Asos's customer base vary: 17 million according to TechCrunch and the BBC, 16.5 million active customers according to Help Net Security, and 23 million according to one tech aggregator.131517 None of these is a count of affected customers. Asos has not given one, and it did not answer the BBC's questions about the scale of the breach.11 Reports of the share price drop also differ: an AFP caption cited a fall of more than 10 percent on Tuesday, while one analysis said the stock fell as much as 15 percent in early trading.16

The list of stolen data also depends on the source. The BBC's account, based on the attackers' sample, includes dates of birth.11 The company's own wording, as reported by the Independent and Bleeping Computer, covers names, contact details and the vague "non-personal" category.418 Until Asos says otherwise, the BBC's more specific account is the better guide to the risk customers face.

Communication failures and regulatory questions

Asos's handling of the incident has drawn as much criticism as the breach itself. The Independent reported about five hours of silence before the full statement.7 One consultant quoted in an analysis said "the hackers are doing a better job of communicating than ASOS is."6 Security researcher Kevin Beaumont compared the retailer's response to the mistakes made by Co-op and M&S during their incidents.7 On Tuesday the BBC reported that Asos had not yet told the Information Commissioner's Office about any breach.17 Which? consumer rights expert Kat Cereda said UK law requires prompt notification when a breach puts personal data at high risk.13 The National Cyber Security Centre has offered its help.13

The sequence of events is the clearest criticism. Asos first described the breach in minimal terms and then expanded its account only after a journalist presented evidence from the attackers. That gives customers good reason to doubt how complete the current picture is.

What customers should watch for

The stolen data can be used to make phishing very convincing. CybaVerse CTO Simon Phillips noted that Asos regularly emails customers about items they have searched for, so attackers could send scams that look like those routine reminders.2 ESET's Jake Moore warned that the data will be valuable to scammers "for many years to come."18 Asos says it will never ask for passwords, security codes or payment details in an unsolicited message.12 Malwarebytes put the key advice plainly: a message that knows your name or your searches is not proof that it came from Asos.7

Bloomberg Intelligence's Charles Allen said the incident may "temporarily cap the pace" of Asos's recovery, because lost trust could slow efforts to rebuild its customer base.2 The lesson for other companies is broader. When marketing platforms hold this much detail about customers, the employees who can log into them become prime targets, and protecting those logins matters as much as patching software.