INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

ASOS Customer Data Exposed in SaaS Security Breach Incident

| 2026-10-09 20:58 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
On October 6, a threat actor known as "Xuanye Group" breached ASOS's customer-facing marketing and notifications platforms, compromising the personally identifying information (PII) of around 17 million customers. The attackers gained access to one employee's login credentials, snowballing an attack that eventually led them to compromise multiple corporate systems, including a system allowing them to broadcast messages to all ASOS mobile app users. The attackers used "Simon AI" - an agentic marketing platform designed for cloud data platforms like Snowflake - to also access customer data, but neither ASOS nor independent researchers have confirmed this detail. The attackers claimed that customer payment information was not at risk and stated that the affected organization's app is safe to use, however, they did compromise names, contact details, non-personal account-related information, addresses, phone numbers, emails, dates of birth, customer ID numbers, and customers' ASOS search histories.
Technical Mitigations AI-generated
• Patch the élan vulnerability in Simon AI, a marketing platform designed to run inside of cloud data platforms like Snowflake. • Monitor for login credentials being impersonated by trusted contacts and implement multi-factor authentication (MFA) to prevent snowballing attacks. • Regularly review notification systems for suspicious activity and block or hunt for indicators such as "fully compromised" claims, which may be used by attackers to gain access to customer data.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA retailretail technologytechnology
Incident Timeline
‎Oct. 6
Threat actors identifying themselves as "Xuanye Group" breached the multibillion-dollar British retailer ASOS on October 6.
source_region United Kingdom
On Oct. 6, a threat actor identifying itself as "Xuanye Group" announced that it had breached the multibillion-dollar British retailer.
‎2026/10/09
Threat actors used the "Simon AI" agentic marketing platform to access customer data and hijack push notifications, claiming they had compromised ASOS's Snowflake instance.
organisation MatchBoil
Related: Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift On Telegram , the threat actor stated that customer payment information was not at risk, and that "the affected organisations app is safe to use.
organisation MFA
The same ethos is less helpful when it comes to cybersecurity, where significant, proactive investments in technologies, personnel, and basic processes — like this year's CAM recommendations around password hygiene, MFA, and anti-phishing protections — can pay off hugely in the long run but carry only costs in the near-term.
organisation ASOS Breach Reveals the Risks in Customer-Facing
ASOS Breach Reveals the Risks in Customer-Facing SaaS. The hackers who breached ASOS this week unearthed a serious security gap around customer-facing marketing and notifications platforms.
organisation ASOS
ASOS Breach Reveals the Risks in Customer-Facing SaaS. The hackers who breached ASOS this week unearthed a serious security gap around customer-facing marketing and notifications platforms.
organisation PII
The group claimed to have stolen a wealth of personally identifying information (PII) about ASOS customers, of which there are around 17 million , according to the company.
victims 17 customers
The group claimed to have stolen a wealth of personally identifying information (PII) about ASOS customers, of which there are around 17 million , according to the company.
organisation CTO
"Impersonating a trusted contact to get an employee's login works on smart, careful people all the time," says Aaron Rose, security architect at Check Point Software's office of the chief technology officer (CTO).
organisation Cybersecurity Awareness Month
In the spirit of Cybersecurity Awareness Month (CAM) 2026, "My recommendation for this year's theme is to look at how far a single stolen login can get someone.
organisation CAM
In the spirit of Cybersecurity Awareness Month (CAM) 2026, "My recommendation for this year's theme is to look at how far a single stolen login can get someone.
organisation Xuanye Group
Xuanye Group then used the access afforded by that account to obtain information about some of the company's third-party platforms.
organisation ASOS] Snowflake
In one hijacked push notification, Xuanye claimed that it had "fully compromised the [ASOS] Snowflake instance.
organisation BBC
" In a conversation with BBC reporters , the attackers indicated that they had used "Simon AI" — an agentic marketing platform designed to run inside of cloud data platforms like the Snowflake AI Data Cloud — to also access customer data.
organisation the Snowflake AI Data Cloud
" In a conversation with BBC reporters , the attackers indicated that they had used "Simon AI" — an agentic marketing platform designed to run inside of cloud data platforms like the Snowflake AI Data Cloud — to also access customer data.
organisation Escape Causes Wikimedia Service Outage
Related: OpenAI Agent Escape Causes Wikimedia Service Outage
victims 2,800 employees
Remarkably, of ASOS's 2,800 employees, the threat actor only needed access to one's login credentials to snowball an attack that eventually led them to compromising multiple, deep-seated corporate systems.
Tactical Metrics
Metrics
victims
17,000,000
Customers
The group claimed to have stolen a wealth of personally identifying information (PII) about ASOS customers, of which there are around 17 million , according to the company.
Metrics
victims
2,800
Employees
Remarkably, of ASOS's 2,800 employees, the threat actor only needed access to one's login credentials to snowball an attack that eventually led them to compromising multiple, deep-seated corporate systems.
Intelligence Sources
Dark Reading 2026-10-09