ASOS breach began with an employee tricked out of their login
ASOS says an attacker impersonated a trusted contact to get an employee's login credentials, then used them to reach customer names and contact details on third-party data platforms. Snowflake says nothing on its side was at fault. The number of affected customers is undisclosed.
UK online fashion retailer ASOS said on October 8 that an unauthorized party got into an employee account by "impersonating a trusted contact to obtain log in credentials," then used those credentials to access information on certain third-party platforms the company uses. ASOS says customer names, contact details and some non-personal account information may have been exposed, but not payment card data or account passwords. It locked down the affected platforms and is working with external investigators, law enforcement and regulators. The incident surfaced on October 6, when ASOS app users received rogue push notifications from a group calling itself "Xuanye" that referred to Snowflake. A Snowflake spokeswoman said the issue did not result from any vulnerability, weakness, flaw or misconfiguration in its service. ASOS has not said how many customers are affected.
Why it matters
The failure here is identity verification of a person, not a platform bug. One phished employee login was enough to reach customer data held in SaaS platforms, which points at two controls: phishing-resistant MFA on every account that can query customer data, and a call-back or out-of-band check before anyone acts on a "trusted contact" request. The help desk social engineering brief covers the verification side, and the Scattered Spider teardown shows the same pattern at retail scale.
It also echoes the 2024 Snowflake customer attacks: the data platform holds, but valid credentials walk straight in. Check which third-party data platforms accept password-only or SMS-based sign-in, and whether network policies limit where those sessions can come from.
Source: BleepingComputer, Snowflake statement via Capital FM
Related on Start with Identity
- BlogFBI removes contractor after a missed patch led to the ShinyHunters breach of employee data
The FBI says a contractor failed to apply a patch to a third-party-managed platform, opening the way for the ShinyHunters breach of employee records. Reuters na
- BlogBinance says a fake job interview and an internal AI tool led attackers to its wallet signing service
Binance's initial findings trace the $6.34 billion theft to a September fake recruiter whose coding assignment infected an engineer's Mac. An internal AI tool l
- BlogChainstack says an attacker reached production through a third-party component and took password hashes
Blockchain infrastructure provider Chainstack says an attacker entered a development environment through a third-party component on October 26, reached producti
- ReportIdentity Breach Report 2026: how attackers get in
123 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 41 with a known MFA status, and 44% of 2025-2026 cases had no login for MFA to protect.
- GlossaryFan-Out Breach
A fan-out breach is an incident in which one compromised identity or credential store at a provider (a support account, an integration's OAuth tokens, an app se
- RecipeAdd login to a Next.js app with OIDC
A complete, copy-paste OpenID Connect login for the Next.js App Router using authorization code flow with PKCE, server-side token exchange, and httpOnly cookies