ASOS Data Breach|Customer Trust Hit 12 Days After Turnaround Upgrade?

1. What was taken, and through whose door

ASOS has confirmed that hackers stole detailed customer profiles, after a ransom note reached shoppers through its own app. It came twelve days after ASOS raised its full-year guidance, and the attack went through the channel it uses to talk to shoppers. All this in the middle of a turnaround. At around ten in the morning on 6 October, thousands of app users saw a push alert headed ASOS HACKED.

It was addressed not to them, but to the company's data protection officer and IT team. "Engage with us, or we will leak it," it read. The shares closed that day down almost ten per cent. Analysts said the attack did not look as disruptive as the one that hit Marks and Spencer. On operations, that looks right.

But the cost that matters here is more likely to sit in customers' trust in ASOS's own channels than in its systems. At first, the picture looked limited. ASOS spoke publicly five hours after the alert. It said basic personal information, including names and contact details, may have been accessed. It did not believe payment-card details or account passwords were affected.

The hackers' Telegram channel was brand new, under a previously unknown name, Xuanye Group. On the first day, a Group-IB researcher said she had seen no sample, dump or other evidence of customer data. The claim was still unproven. That changed on 8 October. The criminals contacted BBC News and said the breach went beyond basic contact details. ASOS then updated its customers.

Names, addresses, phone numbers, emails, customer numbers and dates of birth had been taken, potentially for millions of users. ASOS counted 16.4 million active customers at the end of its financial year. The hackers also had shoppers' searches, such as glamorous wide fit and Asos petite. Bank details and passwords, ASOS said, were not accessed. So the full scale emerged only after the attackers went to the press.

And what they took is not payment data. It is a profile of who each shopper is and what they want. Malwarebytes reported that ASOS stores exactly this kind of profile for its marketing. The ransom note pointed at a supplier. "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance," it began. Snowflake is the American data storage business that serves ASOS. Snowflake rejected that.

A spokeswoman said the issue "did not in any way result from a vulnerability, weakness, flaw, or misconfiguration" with its service. "No remediation is required for Snowflake customers," she added. ASOS gave a third account. It said an unauthorised party "gained access to an ASOS employee account by impersonating a trusted contact to obtain log in credentials".

Those credentials were then used on certain third-party platforms ASOS uses. The hackers named one more piece. They told the BBC they got in through Simon AI, a marketing platform integrated with Snowflake. ASOS's marketing teams use Simon. The Guardian reported that this set-up also enables push notifications to customers' phones. The large Snowflake breaches of 2024 had a similar core.

Attackers used stolen credentials to log into customers' own accounts, where multi-factor checks were not enforced. Here, by ASOS's account, the credentials came from tricking a person. Drapers' editor noted the same method was used against Marks and Spencer in 2025. On the accounts given so far, the weak point sat on ASOS's side: a staff login, and the tools it uses to reach customers.

The cause is not formally settled. But this does not look like a supplier's flaw. It looks like a breach of ASOS's own line to its shoppers.

2. Where the cost lands

The Marks and Spencer attack forced it to shut its online clothing business for a time. It contributed to a 29 per cent fall in annual pre-tax profit. ASOS has seen nothing of that kind. Its website and app kept operating as normal. If damage were measured in downtime, ASOS would have very little to count. Yet orders slowed anyway. Third-party brands sold on ASOS told Drapers that trade had become slow.

One occasionwear brand reported a significant drop in the volume of orders. Drapers said customers feared their card details might not be safe. ASOS had said card data was not accessed. So the cost arrived through fear and demand, not through any outage. By the brands' early accounts, it arrived within a day. That moves the stake from ASOS's systems to its customers.

Twelve days before the alert, ASOS raised its full-year guidance. It said gross merchandise value, its main sales measure, returned to growth in the final quarter. It expected gross margin above 50 per cent. Net debt had fallen to £110 million. The most telling line was about customers. Total customer numbers grew in the fourth quarter, the first such rise since 2022.

The shares had risen nearly 120 per cent in six months. Customers have long been ASOS's soft spot. This is Money said its tough years were partly due to competition from rivals such as Shein. In the same week as the hack, the Guardian reported Shein's UK sales up 26 per cent, to £2.58 billion. ASOS's own sales were £2.47 billion in its year to August 2025. And that figure includes revenue outside the UK.

So Shein's British arm alone now outsells all of ASOS. That is where the hack lands: on the newest, thinnest part of the recovery, winning shoppers back, against a rival now bigger in Britain alone. Any trust ASOS loses now hits the gain its turnaround has only just made.

3. How long the damage runs

Officially, ASOS says its website and app are safe, and customers need take no action. In the same message, it warned them to be "cautious of unexpected messages or calls claiming to be from ASOS". That is sound advice. It is also a retailer asking its customers to doubt messages that carry its own name.

The Armchair Trader noted that this channel is one of ASOS's most important for direct marketing, ahead of the Christmas peak. The stolen profiles are what make that warning necessary. The BBC reported that scammers could use them to build convincing phishing emails or calls. Security experts warn that pairing search history with contact details sharply raises the risk of targeted scams.

Omnisend's ecommerce expert Marty Bauer described the commercial risk. "People let a brand onto their phone because they trust it," he said. "Once that channel has been used to threaten them, they may start questioning genuine messages too." And the hackers still hold the data. Their final statement said it was "safe on our server" and "will not be touched for a designated period".

So locking down the platforms ended the access, not the exposure. The cost can run as long as the data can be used to pose as ASOS. Investors, so far, read it as contained. After the alert, the shares fell as much as 15 per cent. By Friday morning, they stood 5.8 per cent down over five days. ASOS says it holds cyber security insurance with a large global provider, including business continuity cover.

And one brand's chief executive said trade "did slow", but "not as much as I feared". Those facts weigh against a lasting blow. But a calm first week has not always meant a small bill. Craneware, which sells finance software to American hospitals, uncovered a hack on 20 July. It said the immediate impact was contained, with no disruption to customers or core operations.

In September, it cut its revenue expectations anyway, blaming the lingering fallout. The full cost remained unclear, it said, including any hit to future customer engagement. The fit is partial. Craneware sells to hospitals, not shoppers, and faced no public ransom note. But ASOS now stands where Craneware stood in July. Its platforms are locked down.

It says it is "too early to quantify any potential impact on trading". So the claim narrows. The hack is more likely to dent the customer recovery than to break the turnaround. And the size of that dent will show in the figures, not in this week's share price. The alert that opened this story looked like a break-in. It is better read as a test of the customer trust ASOS had only just begun to win back.

On balance, the weight falls on a real but bounded cost, not a derailed turnaround. The first scheduled moment for ASOS to say more is 5 November, when it publishes its full-year results. Watch whether it puts a number on trading since the hack, and what it says about customers. If it reports customers falling back, the loss lands on the newest gain, the customer recovery.

The margin and debt gains made before the hack would still stand. If it reports trading unaffected, this reading overstates the cost, and the open risk shrinks to the data the hackers still hold.

Informational only, not investment advice. Figures and quotes come from the linked reports.