ASOS Confirms Cyberattack, Data Breach

ASOS experienced a cyberattack where hackers compromised a third-party communication platform used for customer notifications, resulting in unauthorized rogue notifications sent to users. The attackers claimed to have fully compromised ASOS's Snowflake instance, a data analysis platform, and threatened to leak data. ASOS confirmed potential exposure of basic user information but no impact on payment card data or passwords. The company’s core website and app were not affected, and operations continue normally. The attack was claimed by the Xuanye Group, with possible links to prior Snowflake breaches by other threat actors. ASOS has taken immediate action to restrict platform access and is collaborating with internal and external experts and authorities. Details about the compromised third-party platform and the exact attack vector remain undisclosed.

Potential exposure of basic user information including names and contact details. No confirmed compromise of payment card information or account passwords. No disruption to ASOS website or application operations. The incident may cause reputational damage and user trust concerns. The rogue notifications sent to users could be used to increase pressure on ASOS via publicity and extortion tactics.

ASOS has restricted access to the compromised third-party notification platform and is working with internal and external cybersecurity specialists and relevant authorities. Users should be informed about the incident and advised to remain vigilant for suspicious communications. Since the company’s website and app were not affected and payment information was not compromised, no immediate password or payment method changes are mandated. Monitor vendor advisories for updates on the third-party platform and Snowflake instance investigations. Patch status is not yet confirmed — check vendor advisories for current remediation guidance.