ASOS Breach Hit Its Customer Messaging Platforms

By
ASOS Breach Hit Its Customer Messaging Platforms
ASOS Breach Hit Its Customer Messaging Platforms
Affiliate disclosure: This post contains affiliate links. If you buy through them, I may earn a commission at no extra cost to you. Full disclosure

ASOS says hackers who broke into the third-party platforms it uses to message shoppers took customer names and contact details.

That matters to you because the same setup sits behind every store with a customer list. If you run email, SMS, push, a helpdesk or a CRM, those tools hold names, phone numbers and addresses, and one compromised login hands an attacker the data plus a megaphone with your brand on it. I track this kind of operator risk here at Ecommerce Paradise, and for a high-ticket store whose buyers spend four figures per order, that customer list is the business.

Below: what ASOS and outside analysts say happened, what is still unconfirmed, and a six-step lockdown you can finish in an afternoon. If you are newer to this model, my guide to high-ticket dropshipping covers why customer trust carries so much weight at these price points. Sources disagree on a few details, and I flag each one.

Customer data incidents land on the business, so form your LLC with Northwest Registered Agent, the best LLC formation service for ecommerce owners. Northwest does not sell your address and puts its own address on your public filings, which keeps your home out of the record that plaintiffs and data brokers read. Form your LLC with Northwest →

ASOS Breach: Fake Push Alerts, Stolen Contact Data, a 15% Share Drop

On Tuesday, October 6, ASOS app users received a push notification headed “ASOS HACKED,” according to BleepingComputer. The alerts began around 5:00 a.m. Eastern, per the same report.

The message was addressed to the retailer’s own staff. It read: “Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.” According to eSecurity Planet, the notice pointed to a Telegram channel run by a group calling itself the Xuanye Group.

ASOS responded the same day. “We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers,” the company said, as quoted by the Yorkshire Post. It told customers to ignore the alert and avoid opening any link inside it.

By Thursday, October 8, the language had hardened. In a London Stock Exchange filing, ASOS confirmed a breach of customer personal information and said names and contact details were taken, per TechCrunch. The BBC reports the stolen data also includes home addresses, phone numbers, email addresses and profile notes such as website search queries, TechCrunch added.

ASOS says it does not believe payment-card information or account passwords were affected. According to SecurityWeek, the company also said its website and app were unaffected and operations were not disrupted.

The market read it as serious. Per a Bloomberg story republished by Insurance Journal, ASOS shares fell as much as 15% in London on Tuesday, the biggest intraday drop since May 2023. ASOS had 16.4 million active customers in more than 100 markets at the end of its 2026 fiscal year, per the same report. The company said it carries cyber insurance and that it is too early to judge the effect on trading.

Two things are still missing. ASOS has not said how many customers are affected, and it has not named the platforms involved. The UK’s National Cyber Security Centre advises all ASOS customers to assume they may be affected, even if they never received the notification, according to eSecurity Planet.

Snowflake’s 2024 Campaign and the Open Questions in ASOS’s Case

The Snowflake name comes from the attackers, not from ASOS. SecurityWeek notes that ASOS’s filing makes no reference to a Snowflake instance. Snowflake told the BBC that its investigation found no compromise of its own platform, per eSecurity Planet.

There is an indirect link. Malwarebytes noted that ASOS uses Simon AI for marketing, and that product runs on Snowflake, according to eSecurity Planet. That would explain why a marketing and messaging stack could expose customer records without Snowflake’s own systems being breached.

The precedent is real. Forescout’s Daniel dos Santos told SecurityWeek that the ShinyHunters group breached Snowflake customer instances at more than 160 organizations in 2024, stole data and used it for extortion, reportedly with credentials taken by infostealer malware. On this case he said: “This recent hack may be similar, although it is not confirmed what the initial access was.”

Some reporting goes further. TechCrunch, citing BleepingComputer, says attackers gained access by “impersonating a trusted contact to obtain log in credentials.” ASOS has not described a root cause, and TechCrunch notes it is unclear whether the ASOS Snowflake instance used multi-factor authentication. It is also unknown how the attackers reached the push notification system, which retailers often run through a third party.

Analysts disagree about motive and origin. Dos Santos said the Xuanye name suggests a Chinese-speaking actor but could be a false flag. Arctic Wolf’s Nick Dyer said the attackers appeared to be using the alert to create panic and pressure ASOS into paying a ransom. Talion Cyber Security’s Natalie Page said “the attackers want to gain publicity around the breach.”

The counting also differs by outlet. Bloomberg puts ASOS at 16.4 million active customers, while TechCrunch cites about 17 million from ASOS’s own website. I would not hang any argument on either figure until ASOS discloses how many records were taken.

I covered a different security hole in how the AI running Shop Pay checkout had a security flaw. This one is a different category: no software bug has been identified yet, and the open question is access control.

Customer Messaging Platforms Are the Soft Target in Your Store

My read is that the lesson here is the route, not the retailer. Nothing in ASOS’s own statements says the checkout, the website or the payment stack failed. The attackers went after the tools that talk to customers.

Three things follow for a store owner.

First, a hijacked messaging channel borrows your credibility. A push alert from a real app, or an email from a real sender domain, gets opened because shoppers trust it. In ASOS’s case the stunt was aimed at the company. The same access pointed at customers could carry a phishing link.

Second, the data is the kind scammers use against high-ticket buyers. Name, phone, address and email are enough to run a convincing “problem with your order” call. My target buyers skew older and affluent, and they are the people most likely to pick up a phone call and trust it. Your phone number is on your site because phone sales win high-ticket orders, so a leaked list pairs your number with the buyer’s number. Keep that in mind when you decide how much to spend on protecting this list.

Third, vendors point at each other, and the merchant answers to the customer. ASOS said “third-party platforms.” Snowflake says its platform was not compromised. The attackers claim otherwise. None of that helps the shopper whose address is in a leaked file. If you sell into the UK or EU, the ICO says a reportable breach should go to the regulator “as soon as possible, and where feasible within 72 hours,” per its breach reporting guidance. The FTC’s data breach response guide lays out the US steps: secure operations, review service provider access, preserve evidence and notify the right parties. I am not a lawyer, and state breach laws vary, so get counsel before you write a customer notice.

Here is hypothetical math, not a reported figure. Say your store has 30,000 email contacts and an attacker sends one hijacked blast. Google’s published sender guidelines say to keep spam complaints under 0.10% and never reach 0.30%. If 1% of that list complains, that is 300 complaints, ten times the ceiling. If email drives 25% of revenue on a $60,000-a-month store, that is $15,000 a month. Losing 40% of inbox placement for a month costs about $6,000 before you pay for cleanup or reputation repair.

My rule of thumb, not an industry standard, comes in three tiers:

Under 5,000 contacts and one admin: multi-factor login on every tool plus an access cull covers most of the risk. From 5,000 to 50,000 contacts, or any VAs and freelancers with logins: add role-based permissions and a quarterly access review. Above 50,000 contacts, or any SMS list: write an incident plan and get a cyber insurance quote, because ASOS itself said it carries cover. My post on business insurance for ecommerce stores covers what to ask a broker.

Map your own stack before you worry about anyone else’s. Klaviyo holds your whole email and SMS list, so it gets the strictest login rules you have. Omnisend is the same story if that is your platform.

A CRM like HubSpot holds the same records plus call notes. My HubSpot setup for a high-ticket store shows which permissions to turn down.

Your helpdesk, such as Gorgias, holds order conversations and addresses. Your Google Workspace admin account sits above all of them, because it can reset every password.

Apps are the other door. Every app you install on Shopify can request customer data scopes, and a pre-order or review app can keep its own copy.

I reviewed one example in my STOQ pre-order app review. AI tooling adds new access paths too, as I laid out in Shopify’s change letting AI agents submit orders, so review which agents and apps hold a key.

Counterpoint: ASOS is a retailer with 16 million customers, and attackers pick targets they can monetize. A store with 3,000 buyers is a smaller prize. That is a fair point, and it explains why you are less likely to be named in the press. It does not change the odds that an automated credential attack finds a weak login. Dos Santos pointed to infostealer-stolen credentials in the 2024 Snowflake campaign, and small stores reuse passwords too.

A high-ticket store with a clean, owned tool stack is an easier business to run and to sell. If you would rather not wire all of this yourself, my team builds the store, sets up the tools under your accounts and runs it day to day through the turnkey done-for-you service.

Want my team to build and run your high-ticket store with every tool login owned by you, not scattered across freelancers? See the turnkey done-for-you service →

Lock Down Your Customer Data Stack This Week: 6 Steps

None of these require a developer. Block out two hours and work through the six steps in order.

  1. List every tool that holds customer data or can message customers: Shopify admin, email, SMS, push, helpdesk, CRM, Google Workspace, accounting and any spreadsheet export. Next to each, write who holds admin access today.
  2. Turn on multi-factor login for every account on that list, using an authenticator app or passkey instead of text-message codes where the tool allows it. In Google Workspace, enforce 2-step verification for all users from the admin console, not as a suggestion.
  3. Remove access you no longer need. Delete ex-freelancers, old VAs and agency logins, drop everyone to the lowest role that does their job, and stop sharing one password across a team. A password manager fixes the sharing problem for a few dollars a seat.
  4. Rotate API keys and app tokens, then uninstall Shopify apps you no longer use. Check which remaining apps can read customer data, and ask support for any that cannot tell you.
  5. Write a one-page incident plan: who pauses all sends, who contacts each platform’s support, who talks to counsel, and who drafts the customer notice. Pre-write the notice. Read the FTC guide above, and note the 72-hour ICO window if you sell to the UK or EU.
  6. Plant a tripwire. Add a test contact on your own email address and phone number to every list so you see any send you did not make, turn on any new-login or export alerts your platforms offer, and check weekly who exported your customer list.

Explore Turnkey Builds for service details and pricing. Email me with questions before getting started.

Customer-facing policies matter too. Termly can generate a privacy policy. Shopify now drafts store policies on its own, as I covered in Shopify’s automated store policies.

Frequently Asked Questions

Did ASOS lose payment card data?
ASOS says it does not believe payment-card information or account passwords were affected, per SecurityWeek. The retailer says names and contact details were taken, and the BBC reports addresses and phone numbers too.

Was Shopify, Klaviyo or any other ecommerce platform involved?
No such claim has been made. ASOS has not named the platforms, and Snowflake says its own systems were not breached. Do not assume any vendor is at fault until ASOS or investigators say so.

What is Snowflake?
Snowflake is a cloud data analytics company, per TechCrunch. Retailers often use tools built on top of it for marketing and customer data, which is why one stolen login can reach a large customer file.

Do I have to tell customers if my store is breached?
Often yes, but the rules depend on your state and any country you sell into. Start with the FTC’s response guide, then ask a lawyer. I am not a lawyer, so treat this as a starting point.

Is a small high-ticket store really a target?
Credential attacks are automated, so size matters less than a weak login. A small store has fewer records to steal, but the damage to one customer who gets scammed over the phone is the same. My chargeback prevention guide shows what a bad customer experience costs once disputes start.

What is the cheapest first step?
Multi-factor login on your Shopify, email and Google accounts costs nothing and takes under an hour. Keep your own devices clean too, and my roundup of antivirus software compares the options.

Anything for my own devices and identity?
If you work from cafes and airports, my guide to setting up Surfshark across your business devices covers the public WiFi side. My Aura vs LifeLock comparison covers monitoring your own identity.

I have not launched a store yet. Where do I start?
Pick a niche first. My free high-ticket niches list is the fastest place to begin, then build security habits in from day one.

Want to compare notes with other store owners on how you lock down your stack? Join the Skool community →

The ASOS story will keep moving as the company discloses the customer count and the platforms involved. I will cover the next real development when it lands. Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.

Related Articles

If this was useful, these go deeper:

Share on Facebook
Post on X
Save
Share