ASOS confirmed attackers got into customer-data systems after tricking an employee into handing over login credentials. Stolen data reportedly included not only names and contact details, but also customers’ shopping searches, which could enable highly convincing follow-on scams and phishing. Attackers also sent an in-app push notification to customers claiming ASOS had been hacked and reportedly demanded a ransom.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ASOS was breached because one employee typed their password into the wrong page. That’s it. They got an email: 'Action required: confirm your login to restore access.' Clicked, saw a login page, and entered their corporate username and password. Those stolen details unlocked ASOS’s third-party platforms and customer data. Attackers then used that one login to pull names, addresses, even search history like 'reclaimed vintage' or 'ASOS petite', perfect fuel for ultra-personalized phishing. They even pushed an in-app alert: 'ASOS has been hacked, see details and next steps' with a link to Telegram. If you ever get an email or alert asking you to 'confirm your login' or move to Telegram, stop. Don’t click, open our official app or site yourself, and verify there.
ASOS says an attacker got into an employee account by impersonating a trusted contact to steal login credentials. Those credentials were then used to access third-party platforms and send a legitimate-looking push notification to customers claiming a Snowflake hack and directing them to a Telegram…
Attackers used social engineering to access an ASOS employee account connected to Snowflake, then used ASOS’s own app notification system to broadcast an extortion message directly to customers. The incident also involved suspected large-scale customer data theft, which increases the risk of highly…
ASOS customers received an unexpected push notification inside the official ASOS app claiming the retailer had been hacked and demanding engagement to prevent data leaks. ASOS confirmed it was an “unauthorised customer notification” tied to third‑party messaging platforms and said it restricted…
ASOS confirmed an unauthorized push notification was sent to customers through its official mobile app, claiming the retailer was “hacked” and threatening to leak data unless ASOS engaged with the attackers. The message attempted to pressure ASOS’ security and privacy teams and directed the company…
Two US Air Force members ran phishing campaigns to steal employee email credentials, then used spoofed emails to impersonate victims or their business partners. They redirected legitimate wire payments, including transfers of $1.68M and $720K, into accounts controlled by the conspiracy, and also…
McKesson disclosed a breach tied to unauthorized access of third-party applications and data theft affecting some customers. The ShinyHunters extortion group claims it used phone-based social engineering (vishing) to steal employee credentials, took over Okta single sign-on accounts, and then…
