When the attacker has your megaphone

At about ten ’clock on the morning of 6 October, people with the ASOS app on their phones received a notification. It did not announce a sale. It was addressed to the retaile’s own data protection officer and IT team, it claimed that a data platform had been compromised, and it told the company to make contact or see the data leaked. It carried a link to a Telegram channel.

The message came through the genuine ASOS app. The attackers had found a way to speak to the compan’s customers in the compan’s own voice.

What happened

ASOS has since confirmed the incident. By its account, an unauthorised party obtained an employe’s login by impersonating a trusted contact, and used that account to reach third-party platforms the company uses to communicate with customers. Basic personal information, including names and contact details, may have been accessed. ASOS says it does not believe payment card details or account passwords were affected. It has restricted access to the platforms involved and is working with outside specialists and the relevant authorities.

A previously unknown group calling itself Xuanye Group claimed responsibility. Its message named Snowflake, the data platform; Snowflake has said its investigation has so far found no compromise of its own systems. ASOS has not said how many customers received the notification or how many had data accessed. It serves more than 16 million active customers in over 100 markets, and its shares fell by as much as 15% in London during the day.

Notice what is absent from that account. There was no sophisticated exploit and no flaw in a firewall. There was a conversation in which someone was persuaded, and a set of connected platforms that trusted whoever signed in.

The breach was the message

Most breaches are discovered quietly and disclosed on the organisatio’s own terms: an investigation, a statement, a letter to customers. This one was announced by the attackers, to the customers, before the company had said a word.

The leverage used to be the data. Increasingly it is the audience.

That is a deliberate shift in how extortion works. A group that can reach your customers directly does not need to prove what it holds. The notification is the proof, and every recipient becomes a witness. A screenshot was soon circulating on Reddit, the story was being reported by national media, and by the end of the day the share price had moved.

The attackers also understood tone. Their channel reportedly reassured shoppers that payment information was safe and that the app could still be used. That is reputation management, performed by the people who caused the incident. It positions them as the credible narrator and leaves the company to respond to a story already written.

Why the damage is systemic

It would be easy to file this under “one employee made a mistake”. That misses the structure that turned a mistake into a public event.

• Identity is the perimeter. One account opened the door to the tools that hold customer details and the tools that send customer messages. Where a single login carries that much reach, a single lapse carries that much consequence.
• Suppliers are part of the estate. The platforms involved belonged to third parties. Customers do not draw that distinction, and neither does a regulator. One supplier was named publicly by the attackers and had to defend its position, whatever the eventual findings.
• Communication channels are critical systems. Push notifications, email platforms and social accounts are usually owned by marketing and treated as lower risk than finance or operations. They are a direct line to every customer the business has. In the wrong hands they are the most efficient way to damage trust at scale.
• The harm outlasts the incident. The information accessed was described as basic. The lasting effects are different in kind: customers primed to distrust genuine messages, the risk of follow-on scams that use the stolen contact details, investor concern, and regulatory attention. None of those is repaired by resetting a password.

A holistic response

The response to this kind of risk cannot sit with the IT team alone, because the failure was not confined to technology. It ran through people, suppliers, communications and governance, and the defence has to as well.

In practice that means asking how identity is verified when someone requests access or a reset, not only whether multi-factor authentication is switched on. It means knowing which outside platforms hold customer data or can contact customers, and what a single compromised account could do inside each. It means treating the ability to message customers as a privileged action with its own approvals and monitoring. And it means rehearsing the scenario in which the first public statement about an incident is made by someone else.

Five questions for the board

1. Who, inside and outside the organisation, is able to send a message to every one of our customers?
2. If one employe’s login were stolen today, which systems and suppliers would it open?
3. How would our help desk or a supplie’s support team verify a caller who claimed to be a colleague?
4. If attackers announced a breach to our customers before we knew about it, who speaks, through which channel, and within what time?
5. When did we last test any of this with people who think like an attacker, and what did they find?

The takeaway

The ASOS incident will be remembered less for what was taken than for how it was announced. Attackers have learned that reach is leverage, and that an organisatio’s own channels are the fastest route to its customers and its share price. Leadership teams that still think of cyber risk as a question of data and systems are defending the wrong boundary. The boundary now includes every voice the organisation speaks with.

Correct as of 13 October 2026. The investigation is ongoing and details may change. Sources: ASOS statements as reported by BleepingComputer and Help Net Security; share price and customer figures from Insurance Journal; Snowflak’s comment to the BBC as reported by Help Net Security.