Asos said Thursday that an unauthorized actor impersonated a trusted contact and persuaded an employee to hand over their work login. With those credentials, the attackers reached information on specific third-party services the retailer uses. The intruders identified themselves as Xuanye Group.
Earlier this week, some shoppers received a push alert in the Asos app threatening to leak data. The message also alleged a breach of Asos's Snowflake setup, a cloud platform used to store large data repositories. The hackers provided no evidence, and a Snowflake Inc. spokesperson said afterward that its service was not breached.
Most breaches start with a person, not a system. Market Briefs covers corporate security free every morning.
Asos says it has locked down the impacted third-party platforms and started a full investigation. The company also emphasized its website and mobile app remain safe to use, and noted there have been no further posts from the hackers since Tuesday.
According to Asos, the attackers currently have access to a subset of personal information, such as names and contact details. The company reported that neither card data nor login passwords were exposed. Shares climbed up to 5.3% in London after the update, as investors digested that the incident was less extensive than initially feared. Earlier in the week, the stock sank after the push alert landed.
UK retailers have faced a run of cyberattacks over the past year, with groups like ShinyHunters going after big names for data. After an attack last year, Marks & Spencer Group Plc spent months in turmoil and paused online orders for clothing and home goods.
Anastasia Tikhonova, Group-IB's global head of threat research, said Xuanye Group first appeared on Telegram in early September as @JohnCzwartacki. The account later switched to @NFTmoonstock, then rebranded to @xuanyegroup on Oct. 6, the same day it claimed the Asos intrusion. She added the account had not previously been tied to cyberattacks and had been active trading online gaming-related items. The UK Information Commissioner's Office has been notified by Asos and is evaluating the situation.
For everyday investors, the watch item is whether the probe uncovers wider data exposure or operational hiccups. So far, Asos says the affected platforms are locked down and that card details and passwords were not accessed, which may limit fallout and compliance costs if that holds.
Credential scams remain the cheapest attack and the hardest to stop. Get the free Market Briefs daily newsletter and follow the fallout.
