Online fashion retailer ASOS said an attacker impersonated a trusted contact to obtain an employee's login credentials and then used them to reach third-party platforms the company relies on, The Record reported Thursday. The explanation follows an unauthorized push notification sent to users of the ASOS app Tuesday, which The Primary Wire reported at the time.

What Happened

According to ASOS, the intruder accessed customers' names, contact details and non-personal account information. Payment card information and account passwords were not accessed, the company said, and its website and app were safe to use throughout.

ASOS has not said how many customers were affected or whether it believes data was copied out of its systems, The Record reported. The company said it locked down the affected platforms and is investigating with external security experts, law enforcement and regulators, according to BleepingComputer. The investigation is expected to take several weeks, and ASOS said it would contact customers if they need to take further action.

RelatedDealership IT Vendor Reports Attack Surge, Says MFA Was in Place When Logins Were Stolen

The breach became public Oct. 6, when ASOS app users received a push notification that directed them to a Telegram channel run by a group calling itself Xuanye Group. The group claimed it had breached ASOS's Snowflake data environment and targeted Simon AI, a marketing service. Snowflake denied being breached, and Simon AI did not respond to The Record's request for comment.

The Record said Xuanye Group is not a name previously known to researchers who track extortion gangs and has not published customer data samples to back up its claims, though it purportedly shared data with BBC News.

Why It Matters

The account points to a familiar route into retailers: rather than breaking through technical defenses, attackers talk an employee out of credentials and then use that access to log into cloud and software-as-a-service tools that hold customer data. Because those tools sit outside a company's own network, a single compromised login can reach large data sets. ASOS has not said whether the same access was used to send the rogue app notification.

The market reaction was sharp. ASOS shares fell more than 10% on the London Stock Exchange after the alert and remained more than 9.5% below their pre-alert level, The Record reported.

Customer Guidance

ASOS told customers there is no action they need to take on their accounts. It warned them to be cautious of unsolicited messages or calls and said it will never ask for passwords, security codes or payment details that way, BleepingComputer reported. Names and contact details are the kind of information phishing crews use to make follow-up scams more convincing.

What to Watch

The open questions are the number of customers affected, whether data was exfiltrated and which third-party platforms were involved. ASOS has said it will provide an update if the investigation turns up significant findings. Also unresolved is whether Xuanye Group releases any data, and whether its claims about Snowflake and Simon AI hold up after Snowflake's denial.