The hackers who breached ASOS this week unearthed a serious security gap around customer-facing marketing and notifications platforms.
On Oct. 6, a threat actor identifying itself as "Xuanye Group" announced that it had breached the multibillion-dollar British retailer. The group claimed to have stolen a wealth of personally identifying information (PII) about ASOS customers, of which there are around 17 million, according to the company. Remarkably, of ASOS's 2,800 employees, the threat actor only needed access to one's login credentials to snowball an attack that eventually led them to compromising multiple, deep-seated corporate systems. One of those systems allowed it to broadcast messages to all of ASOS' mobile app users.
"Impersonating a trusted contact to get an employee's login works on smart, careful people all the time," says Aaron Rose, security architect at Check Point Software's office of the chief technology officer (CTO). In the spirit of Cybersecurity Awareness Month (CAM) 2026, "My recommendation for this year's theme is to look at how far a single stolen login can get someone."
The ASOS Breach
According to a Check Point threat intelligence briefing shared with Dark Reading, ASOS's breach this week appears to be unrelated to a separate cybersecurity incident at ASOS US in July, where attackers likely used credential stuffing to compromise PII, social media, and partial payment data belonging to just under 140,000 individuals.
According to the company's latest update to customers (as of the time of publication), an unauthorized party recently impersonated one of its employees' trusted contacts and, in doing so, somehow obtained the targeted employee's login credentials. Xuanye Group then used the access afforded by that account to obtain information about some of the company's third-party platforms.