ASOS confirms data breach after "hacked" app alert reaches shoppers - Help Net Security
Samantha S. — Product, Go-to-Market & Marketing Leadership
ASOS has confirmed a data breach after customers received an unauthorised notification through its own app claiming attackers had compromised company data.
The incident involves third-party platforms ASOS uses to communicate with customers. The retailer says names and contact details may have been accessed, but it does not currently believe payment card information or account passwords were affected.
The attackers have claimed they compromised an ASOS Snowflake instance, although Snowflake says it has found no evidence so far that its platform itself was compromised.
There’s an important lesson here beyond the breach itself.
Customer communication systems are part of the attack surface.
If an attacker can gain access to a trusted channel such as an app notification, email platform or customer messaging service, they don’t just potentially gain access to data. They gain access to the organisation’s voice.
That creates some very convincing possibilities for phishing, fraud and social engineering.
For security teams, it’s another reason to look closely at who and what has access to customer communication platforms, how those permissions are managed, and how quickly access can be revoked when something goes wrong.
Read more:https://www.helpnetsecurity.com/2026/10/07/asos-data-breach-app-notification/
#Cybersecurity #DataBreach #ThirdPartyRisk #CloudSecurity
8 reactions · 1 comments
Topics: #thirdpartyrisk, #databreach, #cloudsecurity, #cybersecurity
Comments
Schomer: Exceptional analysis, Samantha. This ASOS incident is a textbook example of an Emergent Trust Boundary Violation (ETBV). The dangerous element here isn't just the potential data exposure—it's that the attackers successfully weaponized a high-trust, pre-execution communication channel to hijack the organization's voice. For corporate environments, this proves that managing access solely through app