ASOS has confirmed that an attacker impersonated a trusted contact to obtain an employee's login credentials, gaining access to customer information through third-party platforms used by the online fashion retailer.
In an Oct. 8 update, ASOS disclosed that the credentials enabled unauthorized access to personal information, including customer names and contact details. The findings provided a clearer explanation of the October 6 cyber incident, in which customers received an unauthorized notification via the retailer's mobile app.
The disclosure shifts attention from the alarming message customers received to a broader security problem: how a compromised employee identity can put customer data and trusted communication channels at risk.
ASOS identifies employee impersonation as entry point
In its Oct. 8 customer security update, ASOS said an unauthorized party gained access to an employee account by posing as someone the employee trusted. The attacker obtained login credentials and used them to access information on certain third-party platforms the company uses.
ASOS said it immediately restricted access to the affected platforms and launched an investigation involving internal security teams and external cybersecurity specialists. The retailer also said it was working with law enforcement and regulatory authorities.
The investigation confirmed that the attacker accessed names, contact details, and certain non-personal account information. According to The Guardian, recent customer search histories were also among the information accessed. However, ASOS said its investigation found that no customer passwords or payment card information were accessed.
The company had not disclosed how many customers were affected by the October incident or publicly identified all the third-party platforms involved.
The findings followed the Oct. 6 incident, when an unauthorized party used the retailer's official app to distribute a notification claiming that ASOS had been hacked. The message alleged that the attackers had compromised a Snowflake environment. However, ASOS has not confirmed that claim, and Snowflake denied that the incident resulted from a vulnerability in its systems, according to TechCrunch.
The Oct. 8 disclosure provided a more specific explanation of how the attacker obtained access, although ASOS said its broader investigation was continuing. The retailer had also disclosed a separate security incident involving customer accounts in July. There is no established evidence that the July and October incidents involved the same attackers or were technically connected.
What the credential compromise reveals about third-party security risks
The attack method disclosed by ASOS makes employee identity protection a central issue in the investigation.
Rather than exploiting a publicly disclosed software vulnerability, the attacker obtained legitimate employee credentials through social engineering. That matters because security controls designed to block malicious software or known vulnerabilities may not prevent unauthorized access when an attacker successfully authenticates using compromised credentials.
The incident also demonstrates how third-party business platforms can expand the consequences of a compromised employee account.
Organizations frequently rely on external services to manage customer relationships, store information, and deliver notifications. If an attacker gains access to an account with sufficient permissions, those platforms can become additional paths to sensitive information.
The unauthorized ASOS push notification raises a related concern. Customers may be more likely to trust a message delivered through an official application than one arriving from an unfamiliar email address or phone number.
For security teams, several controls deserve particular attention:
- Strengthen employee authentication. Use phishing-resistant multifactor authentication where supported, particularly for accounts that access customer information or third-party administrative tools.
- Restrict third-party permissions. Limit employee access to the platforms and information required for their roles, and review privileges regularly.
- Monitor trusted communication systems. Alert on unusual administrative activity, unexpected messaging campaigns, and suspicious logins to customer-facing platforms.
Organizations should also establish procedures for rapidly revoking compromised credentials and sessions across connected services.
As eSecurityPlanet explains in its guide to MFA weaknesses, some authentication methods remain vulnerable to phishing, session theft, and other techniques that can bypass protections built around passwords alone.
Security teams should also consider whether third-party providers offer sufficient audit logs, access restrictions, and emergency controls to investigate and contain suspicious activity.
For ASOS customers, the immediate concern is different.
Although the retailer said passwords and payment card information were not accessed during the October incident, exposed names, contact details, and shopping-related information could potentially help criminals craft more convincing phishing messages.
The UK's National Cyber Security Centre advised customers to remain alert for suspicious communications following the incident.
Customers should be cautious of unexpected messages claiming to offer refunds, request account verification, or require urgent security action. Anyone receiving such a message should navigate directly to the retailer's official website or app rather than following an unfamiliar link.
ASOS said customers do not need to take specific account-related action because of the October incident. The company also maintained that its website and app remained safe to use while emphasizing that it would contact customers directly if additional information, support, or action became necessary.
For retailers and other businesses, the central lesson is that securing customer information requires more than protecting the customer login page. Employee identities, third-party platforms, and the systems used to communicate with customers all need strong access controls and continuous monitoring.
The ASOS incident illustrates how compromised employee credentials can create wider risks involving customer information and trusted communication systems.
Related reading: For more ways to protect employee credentials from impersonation attacks, see eSecurityPlanet's 10 strategies for preventing spear phishing.