> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# ASOS breach update: Hackers stole customer details and shopping searches
- URL: https://f4n6.co.uk/security-feed/asos-breach-update-hackers-stole-customer-details-and-shopping-searches/
- Published: 2026-10-09T17:50:18.000Z
- Updated: 2026-10-09T17:50:18.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

ASOS has confirmed that attackers accessed customer information after tricking an employee into handing over login credentials, and the stolen data is broader than the "basic personal information" the retailer first described. Reporting by the BBC, which received a sample from the attackers, shows the exposed records include names, home addresses, phone numbers, email addresses, customer numbers, dates of birth, account start dates, and website search terms. The attackers told the BBC they reached the data through Simon AI, a customer personalisation platform built on Snowflake; Snowflake states it found no compromise of its own platform, and no vulnerability in Snowflake or Simon AI has been established. No CVE, CVSS score, or CISA KEV entry is associated with this item, and no named threat actor has a MITRE profile in our reference data, so the attribution to any tracked group is unconfirmed. The direct risk to EMEA financial services is secondary: the stolen attributes (name, address, phone, email, purchase interests) are high-quality material for targeted phishing and social engineering against customers who also hold bank accounts, and the incident is a credential-theft case study for any institution whose third-party marketing or personalisation platforms are reachable with a single set of employee credentials.

## 2\. Regulatory framing

| Article                                                                 | Trigger (the fact in this item)                                                                                                                               | Practical impact                                                                                                                                                                                                       |
| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28: ICT third-party risk, general principles                  | Stolen employee credentials were used to access customer data held on third-party platforms (Simon AI on Snowflake) that ASOS uses for personalisation.       | A financial entity using comparable marketing or personalisation SaaS must be able to show it has assessed and manages the risk of that provider, including who can reach the data with a single credential set.       |
| DORA Art. 30: key contractual provisions with ICT third-party providers | The breach was discovered and disclosed through the provider relationship, and ASOS says it locked down the affected platforms and launched an investigation. | Contracts with personalisation and analytics providers should specify breach notification timelines, access-control requirements, and audit rights, because the entity, not the platform, carries the disclosure duty. |
| NIS2 Art. 21(2)(d): supply chain security measures                      | The access path ran through a third-party platform rather than ASOS's own core systems.                                                                       | Entities in scope must hold supply chain security measures covering the providers that touch customer data, including credential and access management at the provider boundary.                                       |

No DORA incident-reporting article (Art. 17, 18, 19) is engaged for our clients by this item: the incident is at a retailer, not at an in-scope financial entity, and no client of ours is named as affected. The three rows above are engaged only where a client runs a comparable third-party personalisation or marketing stack.

## 3\. Technical analysis & attack chain

The confirmed chain, from ASOS statements and BBC reporting:

1. Attackers tricked an ASOS employee into handing over login credentials. The source does not describe the method (phishing, MFA fatigue, help-desk impersonation, or other), so the initial access vector is unconfirmed beyond "credential theft via social engineering of an employee".
2. The stolen credentials were used to access information on third-party platforms used by ASOS.
3. The attackers told the BBC they reached the data through Simon AI, a platform built on Snowflake that ASOS uses for customer personalisation.
4. Customer records were accessed and exfiltrated. The BBC received a sample from the attackers and confirmed the contents.
5. The attackers sent a push notification through the ASOS app telling customers the company had been hacked, before ASOS issued its own statement.
6. The attackers are threatening to release the data and reportedly gave ASOS two weeks to make contact, demanding a ransom in exchange for deleting the customer information. ASOS did not disclose whether it would pay.

Data confirmed exposed, per the BBC sample: names and home addresses; phone numbers and email addresses; customer numbers and dates of birth; searches made on the ASOS website; and details such as when a customer started using ASOS. The BBC reported specific search terms including "reclaimed vintage", "glamorous wide fit", and "Asos petite". ASOS states payment card information and customer passwords were not accessed.

On the platform question: the attackers' original notification named Snowflake. Snowflake said it found no compromise of its platform. The source notes that using stolen credentials to access a customer's account or a connected service does not necessarily mean the underlying platform was breached, and that the available reporting does not establish a vulnerability in Snowflake or Simon AI. Treat any claim of a Snowflake platform compromise as unsupported by the reporting to date.

Unconfirmed and single-sourced elements, flagged: the identity of the attackers is not established in the source, and no group is named. The claim that access ran through Simon AI rests on the attackers' own statement to the BBC, which is a single source and an interested party. The ransom demand, the two-week deadline, and the offer to delete data in exchange for payment are reported from the attackers and are not confirmed by ASOS. The exact number of affected customers is not given. The mechanism by which the employee credentials were obtained is not given. There is no technical indicator in the source that would let a defender pivot on infrastructure.

Relevance to financial services: the stolen data set is a targeting list. Name, address, phone, email, date of birth, and purchase-interest data let an attacker construct a message that references a real past interaction with a brand the customer uses, which is the pattern that defeats generic phishing filters and customer scepticism. The credential-theft-to-third-party-platform path is the same path that reaches marketing, analytics, and personalisation platforms at banks and insurers, and those platforms frequently sit outside the core identity perimeter.

## 4\. Mitigation & containment

P1 within 24 hours

- If your institution uses Simon AI, Snowflake, or a comparable personalisation platform holding customer data, confirm with the provider whether any credential or access anomaly has been observed against your tenant, and require written confirmation of the access-control model (who can query customer records, from where, with what authentication).
- Review authentication logs for your own marketing, analytics, and personalisation platforms for logins from unexpected geographies, service accounts used interactively, or bulk export or query activity. The source gives no indicator values, so this is a behavioural hunt, not a signature match.
- Enforce phishing-resistant MFA (FIDO2 or passkeys) on any account that can reach customer data on a third-party platform. The ASOS case turned on a single set of employee credentials; hardware-backed MFA is the control that breaks that path.
- Brief customer-facing fraud teams that ASOS customer data (name, address, phone, email, date of birth, purchase history, search terms) may be used in targeted phishing that references real ASOS activity. Instruct them to treat inbound "ASOS breach" messages as a live campaign, not a hypothetical.

P2 within 72 hours

- Apply least privilege to third-party platform access: remove standing access for accounts that do not need it, and require just-in-time elevation for bulk data queries.
- Check whether any of your customers or staff are in the affected ASOS population and whether your own customer records overlap with the exposed fields, so that fraud monitoring can weight ASOS-referencing social engineering higher.
- Confirm your contracts with personalisation and analytics providers specify breach notification timelines and audit rights, per DORA Art. 30 where you are in scope.

P3 within 7 days

- Add detection for bulk-query and export behaviour on customer-data platforms to your monitoring backlog, since the source describes data access through a legitimate platform rather than malware.
- Review crisis communications runbooks against the ASOS timeline: customers learned of the breach from the attackers first, and the source reports roughly five hours of silence before ASOS's full statement. A pre-agreed holding statement and a named decision-maker for early disclosure reduce that gap.

No vendor patch applies to this item. There is no CVE, no affected product version, and no vendor fix named in the source.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The source names no domains, IP addresses, hashes, file paths, registry keys, or email addresses associated with the attackers.

The source does describe observable behaviours. These are not machine-pivotable atomic indicators and are not placed in the copyable block.

### Behavioural indicators

| Behaviour                                                                                                                              | Where to observe                                         | Confidence                                                         |
| -------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- | ------------------------------------------------------------------ |
| Employee credential theft via social engineering, method unspecified                                                                   | Identity provider logs, help-desk tickets, email gateway | Confirmed by ASOS that credentials were stolen; method unconfirmed |
| Use of stolen credentials to access customer data on a third-party personalisation platform (Simon AI on Snowflake, per the attackers) | Third-party platform authentication and query logs       | Single-sourced to the attackers; verify before acting              |
| Push notification sent through the ASOS app by the attackers                                                                           | Mobile app push infrastructure, app backend logs         | Reported; ASOS customers received it                               |
| Ransom demand with a two-week contact deadline and an offer to delete data                                                             | n/a (extortion communication)                            | Single-sourced to the attackers; not confirmed by ASOS             |

## 6\. Detection

Insufficient indicators to author detection rules. The source contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text, or hard-coded values that are artefacts of the threat itself. The only named entities are the victim (ASOS), the platforms (Snowflake, Simon AI), and a security commentator, none of which are threat artefacts and none of which would produce a rule that detects the threat rather than reporting about it.

## 7\. Sources

- Malwarebytes, "ASOS breach update: Hackers stole customer details and shopping searches", https://www.malwarebytes.com/blog/data-breaches/2026/10/asos-breach-update-hackers-stole-customer-details-and-shopping-searches, 2026-10-09.
- The BBC, as cited within the Malwarebytes report: provided the sample of stolen data and reported the search terms and data fields. The BBC's own URL is not given in the source material.
- The Independent, as cited within the Malwarebytes report: reported the roughly five-hour gap before ASOS's full statement. The Independent's own URL is not given in the source material.
- Kevin Beaumont, quoted in the Malwarebytes report, criticizing the response and referencing Co-op and M&S.

## 8\. Adverse Trace position

We assess this as a moderate-severity data breach at a retailer with a secondary, phishing-enabling impact on EMEA financial services customers rather than a direct compromise of financial infrastructure. There is no CVE, no CVSS score, and no CISA KEV entry in our reference data for this item, and no named actor with a MITRE profile, so we do not assign a vulnerability severity and we treat the attribution as unconfirmed. The platform-compromise claim is single-sourced to the attackers and is contradicted by Snowflake's statement that it found no compromise; we do not endorse it. The data set is the part that matters to our clients: name, address, phone, email, date of birth, and purchase-interest data are enough to build targeted phishing that references real ASOS activity, and the credential-theft-to-third-party-platform path is directly analogous to the marketing and personalisation stacks our clients run. We will monitor for a confirmed attacker identity, any technical indicators, and any ASOS customer notification that names affected data fields, and we will update this advisory if the platform-compromise question is resolved. Clients running Simon AI or Snowflake for customer data should confirm their access-control posture with the provider this week rather than waiting for ASOS's investigation to conclude.

---

[Read the original source →](https://www.malwarebytes.com/blog/data-breaches/2026/10/asos-breach-update-hackers-stole-customer-details-and-shopping-searches?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*