Asos Hackers Took Far More Personal Data Than First Revealed, BBC Finds

The hackers who targeted Asos this week obtained far more detailed customer information than the retailer initially disclosed, according to new BBC reporting. The breach, which began with an audacious rogue notification pushed through the fashion retailer's own app system, now appears to involve rich profiles of potentially millions of shoppers — including home addresses, phone numbers and even what they searched for on the site.

The scale of the incident has escalated significantly since Tuesday, when the attack first became public. What started as a mysterious alert on customers' phones has grown into one of the most brazen retail cyber attacks of the year, drawing in the London Stock Exchange, data-storage giant Snowflake, and warnings from cybersecurity experts that convincing phishing campaigns are likely to follow.

A notification nobody expected

At around 10am on Tuesday 6 October, Asos app users received a push notification unlike anything the company had ever sent. Addressed not to shoppers but to "Asos DPO and IT" — the data protection officer and IT team — it claimed the retailer's Snowflake data instance had been fully compromised: "we have fully compromised the Snowflake instance. Engage with us, or we will leak it."

The message included a link to a Telegram channel named "Xuanye Wen Gateway," run by hackers calling themselves Xuanyewen. On the channel, the group — whose name translates roughly as "Mysterious Splendour" and matches no known hacking collective — told customers that payment information was unaffected and that the Asos app was "safe to use."

Using a company's own customer-notification system to deliver an extortion demand is an unusually public tactic, and it put pressure on Asos in front of its entire user base. Within hours, Asos confirmed the attack and warned shareholders via the London Stock Exchange that some customer information may have been accessed. Shares in the FTSE 250 retailer fell sharply — Reuters reported a drop of around 10 per cent on Tuesday, with The Times reporting falls of up to 14 per cent to 432p at one point.

In that first statement, Asos said only that "basic personal information including name and contact details may have been accessed," adding that it did not believe payment-card information or account passwords were impacted. An email to customers on Tuesday evening told shoppers to disregard the rogue notification and not to click the link it contained.

The data sample that changed the story

On Wednesday evening, hackers claiming responsibility contacted the BBC and shared a sample of the data they say they took. The BBC held back publication of that material so that Asos could warn its customers first — and what the broadcaster found went well beyond "basic contact details."

The sample contained detailed profiles including names, addresses, phone numbers, email addresses and customer numbers — plus searches made on the retailer's website and app. Reported search terms in the accessed data included phrases such as "reclaimed vintage," "glamorous wide fit" and "Asos petite." The implication is that the attackers did not merely scrape a contact list but gained access to a far richer set of customer records.

!ASOS.com branding on a wall with a dog mural Credit: Photo by Eva Rinaldi via Wikimedia Commons (CC BY-SA 2.0).

Following the BBC's findings, Asos issued a fuller update on Thursday. The company said its investigation had found that an attacker impersonated a trusted contact to obtain an employee's login credentials, then used them to access third-party platforms the company uses to communicate with customers. The information accessed, Asos said, included names and contact details alongside "certain non-personal account-related information."

The company said the affected platforms were locked down immediately, that it was working with internal and external cyber specialists as well as law enforcement and regulators, and that it had taken further steps to strengthen its security controls. Its investigation is now complete, Asos said, and it will contact customers directly where additional information, support or action may be required. The shares, which had plunged earlier in the week, recovered some ground on Thursday, trading up more than 4 per cent.

The Snowflake question

Central to the dispute is the hackers' claim to have "compromised the Snowflake instance." Snowflake is a cloud data platform used by thousands of companies to store and analyse information, and its customers were hit by a major data-theft campaign in 2024 that affected Ticketmaster, Santander, AT&T and dozens of others. The hackers claimed they had broken in via something they called "Simon AI."

Snowflake said it had found no compromise of its platform. Cyber experts note that the rogue notification alone does not prove the attackers reached any database — hijacking a notification platform is a very different thing from breaching a cloud data store. Charlotte Wilson of Check Point told the BBC that the Snowflake access remained unverified, and that investigators still needed to establish the entry point and whether customer records were actually copied.

What is clear is that the attackers gained enough access to a real system to reach potentially millions of app users — an achievement that alarmed security professionals regardless of what else was taken. Asos's own account of the attack — stolen employee credentials obtained through impersonation of a trusted contact — points to social engineering rather than a sophisticated technical exploit.

Why the extra data matters

Cybersecurity experts say the newly revealed details make the breach significantly more dangerous for customers. Trevor Dearing, a cyber expert at Illumio, warned shoppers to expect impersonation attacks, because the combination of names, addresses, phone numbers and search history allows scammers to craft phishing emails, texts and calls that look convincingly personal.

A message that greets you by name, quotes your recent searches and arrives from a number you vaguely recognise is far harder to dismiss than a generic scam. Asos echoed the warning in its customer update: "We will never ask you to share passwords, security codes or payment details through an unsolicited message or call." The company says customers do not need to take any action on their accounts but should stay alert to unexpected contact claiming to be from the retailer.

The incident continues a grim run of cyber attacks on British companies and institutions. Recent years have seen the British Library, Marks & Spencer, the Co-op, Jaguar Land Rover and the London Underground all suffer disruptive breaches, some lasting months. Each case has underlined how dependent modern retail is on third-party platforms — and how a single compromised login can cascade into a company-wide crisis.

Part of a familiar pattern

The Asos case also fits a broader pattern in which ransomware and extortion groups go public early to pressure victims. By broadcasting their demand through the victim's own app, the Xuanyewen hackers guaranteed maximum attention — and forced Asos to respond on a timetable not of its choosing. The tactic worked: within hours the retailer had disclosed the attack to the stock market, and within days it had issued a fuller accounting of what was taken.

Whether the group will follow through on its threat to leak the data remains unknown. On its Telegram channel, the hackers said the customer information "is safe on our server, and it will not be touched for a designated period" — language that keeps the threat alive while buying time for negotiation.

For now, Asos says its website and app operated normally throughout and remain safe to use, and it carries cyber security and business continuity insurance with a large global provider. But for potentially millions of customers whose names, addresses and shopping searches are now in criminal hands, reassurance about the app will be cold comfort. The test of Asos's response will come in the weeks ahead, when the first wave of phishing attempts arrives — and shoppers discover just how much a few stolen details can be made to look like trust.

Read more of our technology coverage and business news, including the growing scrutiny of AI-era security practices, the regulatory response to online harms, and how markets are reacting to wider economic pressures.