Cybersecurity · Risk
ASOS case: the app said it had been hacked. It was the hacker who told you.
On October 6, 2026, ASOS customers received a fake notification on their phones saying the app had been breached. The app was not the problem. According to the company, the entry point was a person.
In 30 seconds
- What happened: a fake push notification, with an extortion threat and a link to Telegram, sent to customers on Oct 6, 2026.
- How (company's version, Oct 8): someone posed as a trusted contact, obtained an employee's login and got into third-party platforms.
- What was accessed: customers' names and contact details. Card and password, according to the company, were not.
- The lesson: the risk was in people, vendors, the brand's voice and customer data, not in the application's code.
What happened
| Date | Fact | Source |
|---|---|---|
| 6/10/2026 | Customers receive a fake push notification warning of an alleged hack, with an extortion threat and a link to Telegram. The group that identifies itself is the “Xuanye Group”. | BleepingComputer, Vectra |
| 8/10/2026 | ASOS states that someone posed as a trusted contact, obtained an employee's login and accessed third-party platforms. Data accessed: name and contact details. | BleepingComputer |
What is known and what is not yet known
Confirmed in two sources
- The fake notification reached customers on Oct 6.
- The company attributes the access to social engineering and an employee's login.
- Contact data was accessed; card and password, according to the company, were not.
Not confirmed, so left out of the conclusions
- Which third-party platform was used.
- Whether the employee's account had two-step verification.
- How many customers were affected.
- Link to Snowflake: it circulated in the press, but Snowflake says its platform was not compromised.
- A drop of about 15% in the shares and notification to the British regulator (ICO): they appear in a single source (Vectra).
Executive view: four risks in one case
- People. Social engineering fools the person, not the machine. A single employee login was enough, according to the company.
- Vendors. An external tool with access to your customers is part of your security, even if the contract says otherwise.
- The brand's voice. Whoever gets into the messaging platform speaks as the company to all customers at once, on the most personal channel there is: the phone.
- Customer data. Name and contact details feed follow-up scams, such as a fake “account compromised” alert.
Three questions for Monday
- Which vendors can send messages to our customers?
- Do all of them require two-step verification?
- How quickly would we know about an improper send?
What to decide in the next 30 days
- Take an inventory of who can speak to the customer on the company's behalf (email, SMS, push, WhatsApp, social media).
- Require two-step verification from vendors and from employees with that access.
- Define who approves any mass send, and through which second channel.
- Have the communication plan ready for the day this happens.
Technical view: how the chain works
The diagram below combines what ASOS reported with the general logic of this type of attack. Where there is inference, it is marked.
- Social engineering. The intruder poses as a trusted contact. The target is an employee, and the goal is to obtain the login.
- Legitimate credential. With a valid login, the intruder does not exploit a software flaw: he walks in through the front door. That is why many traditional controls do not alert. (Technical inference; ASOS gave no detail.)
- Third-party platforms. The access led to external tools used by the company. This is the type of platform where contact data and the sending of messages to customers live.
- Push notification. The message was sent through the official channel, so it reached the phone looking like it came from the brand itself. The app itself was not compromised, according to the company.
- Extortion. The message carried a threat and a link to Telegram.
Technical point of attention
When the attack uses a valid credential from a vendor, your internal monitoring may see nothing. Visibility has to exist on the external platforms too: a record of who got in, from where, and of every mass send.
Recommended controls
These are general good practices and recommendations from Vectra's analysis, not facts of the case.
| Goal | Control |
|---|---|
| Prevent | Map all the third parties that speak for you. Two-step verification on everything, preferably with a passkey or an app, not SMS. Confirm out-of-the-ordinary requests through another channel, even when they come from “trusted contacts”. Train the team with real social engineering scenarios. |
| Detect | Alerts for anything out of the ordinary: access from a new location, unusual hours, mass sends. Third-party platform logs centralized and reviewed. |
| Respond | Rotate keys and access regularly, and immediately in case of suspicion. Communication plan ready, with a spokesperson, a base text and an alternative channel to notify customers. |
If you are a customer
- Do not tap the link in the notification. Open the app or the website by typing the address.
- Be suspicious of any contact “from the store” that shows up right afterwards.
- Use a unique password per site and turn on two-step verification.
Terms used in this article
Social engineering · Two-step verification · Passkey · Push notification · Third-party platform · Data breach
At your company, who can speak to all customers at once? Tell us by direct message to @techtraduzida.