ASOS: rogue push notification after employee credential theft

On 6 October 2026 many users of the ASOS app, the British online fashion retailer, received a push notification through the company’s official channel, but written by an attacker. According to ASOS, the cause was not a software vulnerability but a social engineering attack against an employee.

What happened

The notification was addressed to ASOS’s data protection officer (DPO) and IT team: the sender claimed to have fully compromised the company’s “Snowflake instance” and threatened to leak the data unless ASOS got in touch. The message pointed to a Telegram channel run by a group calling itself Xuanye Group.

The same day ASOS announced, including to the London Stock Exchange, that it was investigating unauthorised activity on third-party platforms used to communicate with customers and that it had immediately restricted access to the notification platforms. The share price fell by more than 10%.

On 8 October the company clarified what happened: an unauthorised party gained access to an employee’s account by impersonating a trusted contact to obtain their login credentials. Those credentials were then used to access information on certain third-party platforms used by ASOS, which have since been locked down.

Data involved and diverging accounts

According to the update sent to customers, reported by BleepingComputer, Infosecurity Magazine and The Record, the exposed data includes full names, contact details and some non-personal account information. ASOS rules out access to payment card data and passwords. It has not said how many people are affected or whether data was copied out of its systems; according to The Record the investigation will continue for several more weeks.

The sources diverge on two points:

• Snowflake. The notification mentioned Snowflake, but ASOS never named it. Snowflake said it had found no compromise of its platform and that the incident did not result from any vulnerability or misconfiguration of its service.
• Scope of the data. According to Infosecurity Magazine and The Record, the attacker told the BBC they had gone through a Simon AI instance, a marketing platform integrated with Snowflake, and sent the BBC a data sample. The BBC says the sample also includes addresses, phone numbers, email addresses, customer numbers and searches made on the website: more than the “basic contact details” ASOS initially mentioned. The sample has not been independently verified.

According to Group-IB, speaking to Infosecurity Magazine, the Telegram channel was created on 6 October by an account that previously used other names, linked to gaming-item trading. The Record says the Xuanye Group name was not known to researchers; no data sample has been published so far.

Technical details

There are no CVEs: entry was gained with credentials obtained by deception. Based on what is known, the pattern fits two MITRE ATT&CK techniques: Impersonation (T1656), to obtain the credentials by posing as a trusted contact, and Valid Accounts (T1078), to log in to the platforms with valid credentials. ASOS has not said which channel was used for the deception, nor whether the account was protected by multi-factor authentication. There are no public indicators of compromise beyond the Telegram channel.

The key point is the customer communication platform, run by a third party: a single account was enough to message every app user in the company’s name. As Group-IB notes, sending a notification does not prove possession of a customer database; the reputational and market damage, however, came before any verification.

Impact for European and Italian companies

Many companies rely on SaaS platforms for marketing, push notifications, email and SMS to customers. These platforms hold personal data and speak on the company’s behalf to its entire customer base, yet they are often managed by marketing teams, outside the controls applied to core systems.

For NIS2 entities (in Italy, Legislative Decree 138/2024) supply chain security, staff training and multi-factor authentication are among the required risk management measures. Under the GDPR, unauthorised access to customer data is a breach to be assessed for notification to the supervisory authority within 72 hours.

Finally, the exposed contact details make convincing phishing possible: ASOS urges customers to be wary of unexpected messages and calls in its name.

What to do now

1. Inventory the platforms that talk to your customers: push, email, SMS, CRM and marketing. For each one, check who has access, with which permissions, and who can message the whole customer base.
2. Use phishing-resistant authentication (FIDO2 keys or passkeys) and bring these platforms under corporate single sign-on, so you can revoke a user in one place.
3. Set procedures against impersonation: credentials and codes are never handed over on request, not even to known colleagues or suppliers; requests are verified through an independent channel, such as a call back to a number already on file. This also applies to the helpdesk resetting passwords and MFA.
4. Control mass sends: where the platform allows it, require approval from a second person for campaigns to all customers and alert on out-of-hours sends.
5. Feed SaaS platform logs into central monitoring: logins from new devices or countries, data exports, new API keys, permission changes.
6. Prepare the response plan: how to quickly suspend notifications, revoke sessions and tokens (not just change the password) and inform customers.

How ARXDOME helps

ARX Expose flags company accounts involved in breaches and lookalike domains registered by others, which can be used to impersonate a trusted contact. ARX Sentry collects logs and events from computers, servers and firewalls and, in the SOC identity pages, shows logins, night-time logins and account changes. ARX Retain keeps the logs so that, during an investigation, you can reconstruct what happened and when.

Last updated: 8 October 2026