ASOS hackers took customer searches—and the details to make scams convincing

A scam message that knows what you have been shopping for is harder to dismiss than one sent at random. That is the practical danger in ASOS’s expanded breach disclosure: hackers obtained customer profiles containing ways to reach people alongside searches they made on the retailer’s website. Payment details and passwords were not accessed, the company says, but those exclusions do not make the other information harmless. ^{2 3}

By 8 October 2026, ASOS had told customers that hackers possessed detailed profiles potentially involving millions of users. The BBC reported that an attacker-supplied sample contained names, addresses, phone numbers, email addresses, customer numbers and website searches. ASOS has not disclosed how many people were affected, how many profiles were taken or how much information was downloaded. “Potentially millions” is possible scale, not a confirmed breach total. ²

Reported searches included “reclaimed vintage,” “glamorous wide fit” and “Asos petite.” Pair an interest with an email address or phone number and fraudulent contact could acquire a convincing shopping connection. That is a risk arising from the exposed information—not evidence that a particular customer has been defrauded or that the records have been publicly released. The search examples come from BBC reporting carried by The Guardian. ^{2 3}

The sample establishes neither the contents of every profile nor the size of the complete collection. ASOS’s own statement identifies names, contact details and “certain non-personal account-related information” as accessed, without fully defining the last category. The complete customer email and dataset were not available for independent examination. Nevertheless, the fuller account materially supersedes the company’s initial warning that basic personal information might have been accessed. ^{2 3}

Dozens of recipients told the BBC they received the notification, but that is not a total recipient count. SBS reported receipt on phones in Australia, establishing that the message was not confined to the UK. Nor does its arrival time establish when the intrusion or download began. ASOS’s app and website were described as operating normally in the 6–7 October accounts; shopping availability and protection of customer information are separate questions. ^{1 4}

ASOS says an attacker impersonated a trusted contact to obtain an employee account’s login credentials, then used them to access information on third-party platforms. An unnamed service was used to download customer data. This is an account of credential theft through impersonation—not an established technical vulnerability in the underlying data platform. The services reached, account permissions and access window remain undisclosed. ^{2 3}

The notification claimed, “We have fully compromised the Snowflake instance.” Snowflake said its investigation was ongoing and had so far found no compromise of its platform. Cybercriminals using the name Xuanyewen separately told the BBC they accessed information through Simon AI, described as a platform built on Snowflake. That specific route has not been independently established. ^{1 2}

An ASOS-associated instance, a service built on Snowflake and Snowflake’s underlying platform are not interchangeable. Stolen credentials can open a customer environment without proving that the infrastructure provider itself was breached. The available findings do not settle which environment was accessed. The notification’s extortion-style threat also establishes no verified ransom amount or payment. ^{1 2}

Group-IB research reported by Infosecurity linked the account associated with the Telegram channel xuanyewengateway, which appeared in the notification, to earlier gaming-item trading activity. OSINTsights distinguished the channel’s creation on 6 October from its administrator’s older online history. This is an account-history association, not identification of a real-world attacker—or proof that the channel controller, notification sender and data thief were the same person. ^{23 39}

Cybernews’s 7 October account said researchers had not found leaked files or samples proving possession of ASOS customer records. The 8 October disclosure and BBC examination of a sample advance that earlier evidentiary position. They do not validate the specific claim of full Snowflake compromise. ^{26 2}

The latest ASOS statements say payment-card information, bank details and account passwords were not accessed. That is firmer than the initial assessment that cards and passwords were not believed impacted. ASOS told customers they need not take action, while warning them about unsolicited contact. Cybersecurity expert Trevor Dearing separately recommended changing passwords as a precaution and watching for suspicious activity; that recommendation is not evidence that ASOS passwords were stolen. ^{1 2 3}

BBC advice published on 6 October told customers to disregard the unauthorised push notification and not engage with it; the message contained an external link. Skint Dad subsequently reported NCSC advice to assume exposure even without receiving the notification. The exact wording was not visible in the available first-party NCSC passage, and precautionary guidance is not a finding that every customer’s information was accessed. ^{21 14 9}

Regulatory engagement has moved forward, but its formal status remains unclear. The BBC’s 6 October report said ASOS had not informed the Information Commissioner’s Office as of that account. On 7 October, the ICO publicly acknowledged customers’ concerns and encouraged caution with links and attachments. By 8 October, ASOS said it was working with law enforcement and regulators. Neither the available ICO statement nor that company description establishes when a formal breach report was received; there is no supported finding here that ASOS missed a reporting deadline. ^{1 6 3}

The retailer’s reach makes the missing count consequential, but cannot fill it in. The initial report cited more than 10 million Android app downloads, around 17 million annual customers and more than 150 markets. Downloads are cumulative installations, not exposed people; annual customers and markets are business-scale measures, not breach totals. ¹

Investors reacted sharply, although the reported percentages remain unsettled. BBC News on 6 October described a fall of around a tenth that Tuesday. FRANCE 24 English that evening reported a 12% intraday maximum and a 7% closing loss. SBS News on 7 October reported a 10% overnight decline. The BBC and SBS descriptions do not specify exact observation times or comparison prices; intraday and closing moves are different measures. ^{1 5 4}

The FT historical-price record gives a 6 October close of 454.00p and daily low of 426.50p. Against Daily Political’s reported previous close of 502.00p, those imply declines of 9.56% and 15.04%, respectively—different from FRANCE 24’s figures. The calculations remain conditional because the available FT excerpt did not expose the prior-day row. Shattered.io’s separate intraday account gave up to 13.2% and 439p, above the recorded full-day minimum. No established evidence attributes the whole day’s movement exclusively to the breach. ^{33 31 5 29}

The central question is no longer whether this was merely a disturbance in a notification system. Customer profiles were taken. The missing answer is whose—and customers still lack a definitive accounting of their individual exposure.

BBC News supplied the initial notification account ¹, expanded profile reporting ², its RSS version ⁷, the BBC.com notification account ²⁴, live coverage ^{12 25} and customer advice ²¹. The Guardian supplied the customer statement in its business live coverage ³. SBS News ⁴ and FRANCE 24 English ⁵ supplied broadcast accounts.

Official material comprised the ICO’s ASOS statement ⁶, ASOS’s announcement carried by Investegate ⁸, and the NCSC incident page ⁹ and PDF ¹⁰. Other incident coverage came from BleepingComputer ¹¹, Drapers ¹³, Irish Independent ¹⁵, Retail Insight Network ¹⁸, SecurityWeek ¹⁹ and Daily Mail ²⁰.

Customer guidance and further coverage included Skint Dad ¹⁴, ALLATRA Media ¹⁷, and The Independent’s protection guide ¹⁶, expanded breach account ²², credential-theft report ³⁷ and notification explainer ⁴¹. Cybernews supplied its earlier evidence assessment ²⁶.

Account-history reporting came from Infosecurity’s Telegram investigation ²³, OSINTsights ³⁹ and Tech Debrief ⁴⁰. Additional notification coverage came from Infosecurity ³⁸, Forbes ³² and The Paypers ⁴².

Market sources were the FT historical-price table ³³, Daily Political ³¹, Shattered.io ²⁹, Global Banking & Finance Review ²⁷, Sharecast ²⁸, AskTraders ³⁰, FashionNetwork ³⁴, Investors Chronicle’s historical-price page ³⁵ and The Sunday Guardian ³⁶.