How the breach unfolded

ASOS said on Thursday that an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain log-in credentials. The credentials were then used to reach information on third-party platforms the retailer uses. In its email to customers, sent on Thursday morning, ASOS said it had undertaken a detailed investigation over the past 48 hours. The company said it is working with the relevant law enforcement and regulatory authorities and has already taken additional steps to strengthen its security controls.

The affected platforms were immediately locked down, ensuring that no further information could be accessed.

What data was exposed

ASOS said the attacker gained access to some personal data, including names and contact details, as well as what it called 'certain non-personal account related information' without specifying what that was. No payment card information or account passwords were accessed, the company said. Cyber criminals who contacted BBC News claimed the breach also covered customer addresses, phone numbers, emails and customer numbers. The number of affected customers in the Netherlands is not yet known. ASOS said it will contact customers directly once its investigation is complete where additional information, support or action may be required.

The Tuesday notification

Thousands of app users received a push notification on Tuesday morning titled 'Asos hacked', which linked to a Telegram account. The message was addressed to 'Dear ASOS DPO and IT' and said the hackers had 'fully compromised' the Snowflake instance, ending with 'Engage with us, or we will leak it.' The group calls itself the Xuanye Group, and cyber experts said they had not heard of it before and that the push notification could be an attempt to gain wider attention. The Telegram channel told customers that 'payment information is not affected'. The hackers have not indicated how much data they possess. ASOS has 17 million customers, according to its website.

Market reaction and Snowflake's response

ASOS shares fell about 10% after the notification on Tuesday. On Thursday they rose 3%, paring the week's losses to 8%. Snowflake said it had 'found no compromise' of its platform after launching an investigation into the notification. That statement contradicts the hackers' claim that the Snowflake instance was fully compromised.

A wider pattern of attacks

Social engineering operations, in which hackers impersonate workers to gain access to companies' computer networks, are prevalent. British companies and institutions have been increasingly hit by aggressive and regular cyber and ransomware attacks in recent years. The British Library, a blood testing service, the London Underground, Marks & Spencer, the Co-op and Jaguar Land Rover have all suffered months of disruption due to such breaches. ASOS now joins that list of British organisations disclosing a breach this year.