ASOS Breach: Impersonation Stole Employee Login

ASOS says an attacker got into an employee account by impersonating a trusted contact to steal login credentials. Those credentials were then used to access third-party platforms and send a legitimate-looking push notification to customers claiming a Snowflake hack and directing them to a Telegram channel. ASOS says payment information was not compromised.

Key findings

• ASOS says the attacker accessed an employee account by impersonating a trusted contact to obtain login credentials.
• Stolen employee credentials were used to access third-party platforms used to communicate with customers.
• The attacker used that access to send customers a legitimate-looking push notification claiming a Snowflake compromise and requesting engagement.
• The push notification linked to a new Telegram channel; the attacker used names 'Xuanyewen' and 'Xuanye group'.
• The attacker claimed the incident only involves “customer information,” but a BBC-reported sample allegedly included shopping searches and other details beyond basic contact info.
• Snowflake stated it found no compromise of the Snowflake platform.

Who’s being targeted

• Commonly targeted roles: Marketing, Customer Support, IT, Security, Privacy/Data Protection, Employees with access to third-party customer messaging platforms.
• Affected industries: Retail / e-commerce, Software / SaaS (third-party marketing and data platforms).
• Attack channels: email, website.
• Impersonated: Trusted contact (known partner/vendor/contact), Appears to be an internal message involving ASOS DPO/IT (delivered to customers via a trusted ASOS channel).

Awareness takeaways

• Train staff to never share passwords, especially when a request appears to come from a ‘trusted’ contact.
• Limit and monitor employee access to third-party customer-communication platforms because a single stolen account can be used to message customers at scale.
• Teach teams that real incident response will not ask them to ‘engage’ attackers via Telegram or other unofficial channels.
• Coach customer-facing teams to warn customers that legitimate-looking notifications can be abused, and to verify unusual security messages through official channels.

Red flags to watch for

• Unexpected request to share passwords/login details
• Request comes from someone 'trusted' but is unusual or urgent
• The request bypasses normal secure access processes
• Message routes the recipient to Telegram to 'resolve' a security incident
• Security claims delivered via a marketing/push channel rather than official incident communications
• Unusual addressees (message seemingly addressed to DPO/IT but sent to customers)