ASOS Reports Data Breach Involving Stolen Employee Credentials

UK fashion retailer ASOS has alerted its customers about a data breach that occurred on October 6, during which a threat actor accessed personal and customer account data. In an email sent to customers on October 8, ASOS confirmed that payment information was not compromised and that the incident has not impacted its operations.

The compromised credentials were reportedly used to access information on certain third-party platforms utilized by ASOS. In a statement released to the London Stock Exchange on October 6, ASOS indicated that it is investigating these third-party platforms that were used for customer communication.

The breach allowed the threat actor to send a push notification that appeared legitimate to ASOS customers. This notification, which seemed to be directed at ASOS’s data protection officer and IT team, claimed that the attacker had compromised a Snowflake instance and requested engagement from the company.

Snowflake, a cloud-based data platform, is employed by companies to store, manage, analyze, and share large volumes of data. A spokesperson for Snowflake stated that they began investigating the incident as soon as they became aware of the push notification. They reported that, at this time, there is no evidence of a compromise of the Snowflake platform.

Potential Links to Marketing Platform Explored

However, Pieter Arntz, a senior malware intelligence researcher at Malwarebytes, suggested that Simon AI, an agentic marketing platform used by ASOS, might be indirectly linked to the breach due to its construction on Snowflake Cortex AI. Simon AI’s website highlights its partnership with ASOS, as well as with American brands Bombas and Equinox.

On October 8, the BBC reported on a conversation between cybersecurity reporter Joe Tidy and the threat actor, who claimed that a Simon AI instance was compromised to gain access to the data. The attacker, using the name ‘Xuanyewen’ and associated with the ‘Xuanye group,’ stated that the incident only involved customer information, which they claimed would remain safe on their server for a designated period.

Intelligence Reviewed

The BBC also noted that a sample of the stolen data sent by the threat actor contained more than just basic contact details, including names, addresses, phone numbers, emails, customer numbers, and search terms that customers had used on the ASOS website.

Anastasia Tikhonova, global head of threat research at Group-IB, found that the Telegram channel linked to the push notification was newly created on October 6 and previously had other names associated with gaming item trading. This raises further questions about the nature of the breach and the motivations behind it.