Hackers pulled detailed Asos profiles, raising phishing risks

Asos now says criminals hold detailed customer profiles that may cover millions of users. The data includes:

• full names and dates of birth
• home addresses and phone numbers
• email addresses and Asos customer numbers
• searches made on the Asos website

The sample also showed how long people had been customers. One shopper, Harriet, has used Asos since 2019, and the hackers know that too. She said it was “very unsettling” and worried the data could fuel future attacks long after the original break-in.

Asos says no bank details or passwords were accessed. It has not said how many accounts are affected, despite repeated questions.

The breach became public in an unusual way. On Tuesday, October 6, Asos app users got a push notification titled “ASOS HACKED”. It was addressed to the company’s data protection officer and IT team, claimed the attackers had compromised Asos’s Snowflake account and pointed readers to a Telegram channel.

Later that day Asos told the London Stock Exchange an unauthorized third party had sent the alert and that basic personal information, including names and contact details, might have been accessed. Customers got an email with similar wording.

On Wednesday evening the group behind the attack contacted journalists with a sample of the stolen data that showed far more than basic contact details. Asos then sent customers a fuller warning confirming that data profiles had been taken.

This wasn’t a clever piece of code. It was a con. Asos says the attackers pretended to be a trusted contact of one of its employees and talked that person into handing over login credentials. With that login, they reached certain third-party platforms Asos uses and downloaded customer data.

The group, which has called itself Xuanyewen and Xuanye Group, claims it used a tool called Simon AI, built on top of the cloud data company Snowflake, to get at the records. Snowflake has said its own platform was not breached. Snowflake customers have been hit before when attackers used stolen logins.

The hackers also told customers their information wouldn’t be misused for a set period, which suggests a ransom deadline for Asos. The UK’s National Cyber Security Centre is helping the company respond.

Security experts point to a weak spot here. Marketing and notification tools often sit outside a company’s tightest controls. The fact that criminals could push a message through Asos’s own app shows how much access they had.

The real danger now is phishing: fake emails, texts and calls designed to look genuine. With your name, birthday, address and shopping habits, a scammer can write a message that sounds exactly like a real retailer, a delivery company or even your bank.

Trevor Dearing, a security director at Illumio, warned that scammers will likely mention the Asos attack, use personal details to look legitimate and create a false sense of urgency, such as threatening to lock your account within 24 hours. Because passwords weren’t stolen, any message asking you to change or share yours out of the blue should set off alarms.

Asos has been clear on one point: it will never ask for passwords, security codes or payment details in an unexpected message or call.

Asos isn’t alone. UK retailers Harrods, Marks & Spencer and the Co-op were all hit by cyber attacks or data breaches in 2025, and the Marks & Spencer attack forced it to halt online orders.

Asos says customers don’t have to take any action and that its website and app are safe to use. Security experts still suggest a few sensible steps:

• Change your Asos password as a precaution, and change it anywhere else you used the same one.
• Don’t click links in emails or texts that mention the breach. Open the Asos app or type the address yourself instead.
• Be wary of calls that quote your birthday or address back to you. That’s no longer proof someone is legitimate.
• Watch your bank and card statements, and turn on extra login checks for your email account.

Asos says its investigation is continuing with outside experts, police and regulators, and it will contact customers directly if they need to take extra steps.