Reported by 5 outlets
ASOS links data breach to social engineering attack, credential theft
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.05 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.2 / 10 = base × recency + community
Desk analysis
ASOS confirmed a data breach caused by a social engineering attack that compromised an employee's credentials. The attacker, calling themselves Xuanye Group, used the stolen credentials to access third-party platforms used by ASOS. ASOS stated that basic personal information and contact details may have been exposed, but payment card data was not accessed. The company locked affected platforms and launched an investigation with external experts, law enforcement, and regulators. Customers received push notifications through the ASOS app and follow-up emails confirming the exposure scope.
Timeline
-
original reporting
ASOS links data breach to social engineering attack, credential theft
bleepingcomputer.com · 5d ago · October 8th, 2026
UK fashion retailer ASOS confirmed that a recent data breach was caused by a social engineering attack in which hackers stole an employee’s login credentials and used them to access information on third-party platforms used by the company. "We discovered that an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain log in credentials," reads an ASOS security notification shared with BleepingComputer. "Those credentials were then used to access information on certain third-party platforms used by ASOS." The company locked down the affected platforms and launched an investigation with support from external experts, law enforcement, and regulatory authorities. ASOS is a large UK-based online fashion retailer that sells clothing, footwear, accessories, and beauty products to customers worldwide. On October 6, 2026, ASOS customers received a push notification through the ASOS app on their mobile devices, alleging customer data theft and urging the company’s staff to engage with them on Telegram. The threat actor, calling themselves “Xuanye Group,” claimed that they had stolen customer data, but not payment information. ASOS eventually confirmed via a statement published on its website that it had suffered a data breach that may have exposed some “basic” personal information and contact details. The latest update sent to customers confirms that the following details were exposed: ASOS says hackers did not access payment card infor
-
update from www.bbc.co.uk
Asos warns customers about full extent of data breach after BBC contacted by hackers https://www.bbc.co.uk/news/articles/c3zxjdw5ywgpo?at_me
www.bbc.co.uk · 5d ago · October 8th, 2026
Asos warns customers about full extent of data breach after BBC contacted by hackers https://www.bbc.co.uk/news/articles/c3zxjdw5ywgpo?at_me
via Mastodon https://www.bbc.co.uk/news/articles/c3zxjdw5ywgpo?at_medium=RSS&at_campaign=rss
-
update from www.standard.co.uk
Asos says 'unauthorised party' impersonated contact to gain log-in details https://www.standard.co.uk/news/tech/asos-telegram-press-associat
www.standard.co.uk · 5d ago · October 8th, 2026
Asos says 'unauthorised party' impersonated contact to gain log-in details https://www.standard.co.uk/news/tech/asos-telegram-press-associat
via Mastodon https://www.standard.co.uk/news/tech/asos-telegram-press-association-b1300009.html
-
update from www.theguardian.com
Asos says customer data accessed by hacker posing as trusted contact https://www.theguardian.com/business/2026/oct/08/asos-customer-data-acc
www.theguardian.com · 5d ago · October 8th, 2026
Asos says customer data accessed by hacker posing as trusted contact https://www.theguardian.com/business/2026/oct/08/asos-customer-data-acc
via Mastodon https://www.theguardian.com/business/2026/oct/08/asos-customer-data-accessed-hacker-posing-impersonated
-
mentioned by www.bleepingcomputer.com
🤖 ASOS confirms a data breach after a social engineering attack and credential theft; hackers accessed some customer personal data. The UK r
www.bleepingcomputer.com · 5d ago · October 8th, 2026
-
mentioned by www.bleepingcomputer.com
"ASOS links data breach to social engineering attack, credential theft" "[...] ASOS is sending updates to affected customers about the cyber
www.bleepingcomputer.com · 5d ago · October 8th, 2026
-
mentioned by www.infosecurity-magazine.com
ASOS recently experienced a data breach after hackers gained access through a third-party marketing tool. If you have an account, keep an ey
www.infosecurity-magazine.com · 5d ago · October 8th, 2026
-
update from www.bleepingcomputer.com
# ASOS links # DataBreach to # SocialEngineering attack, credential theft https://www. bleepingcomputer.com/news/secu rity/asos-links-data-b
www.bleepingcomputer.com · 4d ago · October 9th, 2026
ASOS links # DataBreach to # SocialEngineering attack, credential theft https://www.