The customer data stolen from global fashion retailer ASOS includes more than just names and contact details, raising questions about its early reassurances.

As we reported earlier this week, ASOS customers received a push notification through the ASOS app alleging that the company had been hacked.

ASOS has confirmed that attackers accessed customer information after tricking an employee into handing over login credentials. While the retailer says payment card information and customer passwords were not accessed, reporting by the BBC shows the stolen information includes more than the “basic personal information” initially mentioned by the company.

The stolen login details were used to access information on third-party platforms used by ASOS. The company says it locked down the affected platforms and launched an investigation with internal and external specialists. It also says it has strengthened its security controls.

What data was stolen?

In our initial coverage, we highlighted the potentially detailed customer profiles associated with ASOS’s marketing setup. The BBC’s findings now establish that at least some shopping-related information was taken.

According to the BBC, which received a sample from the attackers, the exposed data includes:

• Names and home addresses
• Phone numbers and email addresses
• Customer numbers and dates of birth
• Searches customers made on the ASOS website
• Details such as when a customer started using ASOS

The BBC reported search terms including “reclaimed vintage,” “glamorous wide fit,” and “Asos petite.” That makes this more than a stolen contact list. The information can also reveal customers’ shopping interests and their relationship with the retailer.

The attackers’ original notification named Snowflake, a data storage and analysis platform. They subsequently told the BBC that they accessed the information through Simon AI, a platform built on Snowflake that ASOS uses for customer personalization.

Snowflake said it had found no compromise of its platform. Using stolen credentials to access a customer’s account or a connected service does not necessarily mean the underlying platform was breached. The available reporting does not establish a vulnerability in Snowflake or Simon AI.

ASOS’s communication with customers

Customers first heard about the breach from the cybercriminals, rather than the retailer. The attackers’ decision to send a notification through the ASOS app may have made that unavoidable.

But the Independent reported that ASOS’s full statement followed roughly five hours of silence, leaving customers alarmed by the notification and waiting for an explanation.

Security expert Kevin Beaumont criticized the response:

“ASOS are experiencing the exact same PR gaffs as Co-op and M&S by not being honest with customers. If you’re dealing with Advanced Persistent Teenagers you need much better crisis plans.”

While the attackers are threatening to release the data, ASOS says its full investigation will continue over the coming weeks. It will contact customers directly where it believes further information, support, or action is required.

Reportedly, the group gave ASOS two weeks to make contact and said it wanted a ransom in exchange for deleting customer information. ASOS did not disclose whether it would pay.

How to stay safe

ASOS says its website and app remain safe to use, and that payment card information and customer passwords were not accessed. But the stolen details and shopping searches could help scammers make targeted phishing messages more convincing.

A message that knows your name, or what you searched for, isn’t proof it came from ASOS.

• Be wary of unexpected emails, texts, or calls about the breach, refunds, deliveries, or problems with your ASOS account.
• Don’t follow links in unexpected messages, and don’t follow the Telegram link in the attackers’ message or engage with them. Go directly to the ASOS website or app to check your account.
• Don’t share passwords, security codes, or payment details in response to an unsolicited message or call. ASOS says it will never ask you to do this.
• If your data was stolen in this breach, read the tips in our blog Involved in a data breach? Here’s what you need to know.

Your name, address, and phone number may already be for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way. 

Thousands of global fashion retailer ASOS customers have received a push notification through the ASOS app this morning alleging that the company has been hacked.

The notification, addressed to ASOS’s data protection officer and IT, says:

“ASOS HACKED

Dear Asos DPO and IT, we have fully compromised ​the Snowflake instance. Engage with us, or we will leak it”

What we know so far

Snowflake is a cloud-based data platform that organizations use to store, process, and analyze data. We know that ASOS’s marketing team uses Simon AI from a blog posted by Simon. Simon AI specializes in personalization and runs on Snowflake. ASOS has described using Simon AI alongside Braze to personalize and trigger customer communications like push notifications to clients’ phones.

The apparent delivery of the message through ASOS’s own app makes this more concerning than an unsupported social-media claim. It suggests unauthorized use of the notification infrastructure, but does not confirm that the claimed Snowflake compromise occurred or that customer data was stolen.

According to Simon AI, typical customer profiles cover:

• browsing history and products viewed
• purchase history and customer value (first-time or high-value buyers)
• demographic data
• segments such as Premier status or customers who’ve stopped buying
• geolocation and local weather

If the affected systems contain these profiles, a breach could expose a detailed picture of customers’ shopping habits and preferences. However, the published description of ASOS’s marketing setup does not establish what, if anything, the attackers accessed.

The Guardian reports that the group claiming the breach calls itself the “Xuanye group.” The Telegram channel operated by the group carried the message “Regarding Asos, payment information is not affected,” and the “app is safe to use” but those claims have not been independently verified.

Sky News reports that ASOS confirmed an “unauthorised customer notification” was sent at around 10 am today. 

“We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers,” it said in a statement.

The retailer said it immediately restricted access to the notification platforms and is working with specialists and relevant authorities. 

It added:

“Basic personal information including name and contact details may have been accessed. We do not believe that payment-card information or account passwords, were impacted.”

How to stay safe

The website and app remain operational, and there is currently no verified evidence that customer databases, payment card information, passwords, etc. have been stolen.

So, it’s too early to say if and how much ASOS customer data the attackers could get their hands on, but the potential scope is significant. Customer data could be used in targeted phishing attacks to add credibility.

• For the time being, postpone your purchases at ASOS until it’s clear what happened and whether ASOS has resolved the issue.
• Be wary of unsolicited messaging about the breach or other ASOS related issues.
• If you do not wish to see more push notifications from the Xuanye group, remove the ASOS app until their access has been removed.
• If it turns out your data was stolen in this breach, read the tips in our blog Involved in a data breach? Here’s what you need to know.

A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud provider Snowflake. Connor Riley Moucka, of Kitchener, Ontario, also admitted to stealing call and text history records of more than 100 million AT&T customers.

A surveillance photo of Connor Riley Moucka, a.k.a. “Judische” and “Waifu,” dated Oct 21, 2024, 9 days before Moucka’s arrest. This image was included in an affidavit filed by an investigator with the Royal Canadian Mounted Police (RCMP).

The U.S. Justice Department said between February and October 2024, Moucka and co-conspirators used stolen login credentials to steal cloud-hosted data belonging to at least 165 customers of a U.S.-based software-as-a-service company.

The hackers targeted stolen credentials for Snowflake customer accounts that did not enforce multi-factor authentication, and extorted or attempted to extort a host of well-known companies, including TicketMaster, Lending Tree, Advance Auto Parts and Neiman Marcus. Snowflake responded to the data thefts by increasing password complexity requirements and enforcing multi-factor authentication.

Moucka adopted new nicknames frequently — sometimes operating multiple identities concurrently — but two of his best-known monikers were “Judische” and “Waifu.” Judische’s admitted role in the Snowflake data thefts was first documented by KrebsOnSecurity in a September 2024 story about the overlap between Western, English-speaking cybercriminals and extremist groups that harass and extort minors into harming themselves or others.

That September 2024 story identified Judische as a software engineer from Ontario who has been involved in numerous data breaches and voice phishing attacks against U.S. companies since at least 2020. A little more than a month later, Canadian authorities arrested Moucka on a provisional warrant from the United States.

The government says Moucka and others used their unauthorized access to steal billions of sensitive customer records and download terabytes of information, “including individuals’ non-content call and text history records, banking and other financial information, payroll records, Drug Enforcement Administration (DEA) registration numbers, driver’s license numbers, passport numbers, social security numbers and other personally identifiable information. They then extorted victims by threatening to publish data online.”

Moucka also threatened and harassed government officials and security researchers who were helping to track him down. The Justice Department said the conspirators made over $2.5 million in ransom payments, and that in at least one instance, Moucka re-extorted a victim with threats of further disclosure of the victim’s stolen data.

“Moucka used the stolen data of a government officer and members of a then-former government officer’s immediate family in this re-extortion attempt,” reads a statement from the Justice Department.

One of Moucka’s admitted co-conspirators is Cameron “Kiberphant0m” Wagenius, a U.S. Army soldier who pleaded guilty in July 2025 to extorting AT&T and Verizon for their customer account data. Less than a month before Wagenius’s arrest, KrebsOnSecurity published a deep dive into Kiberphant0m’s various Telegram and Discord identities over the years, revealing how the owner of the accounts told others they were in the Army and stationed in South Korea.

One of several selfies on the Facebook page of Cameron Wagenius.

Kiberphant0m also re-extorted victims. Immediately following Moucka’s arrest, Kiberphant0m posted on hacker forums what he claimed were the AT&T call logs for then President-elect Donald Trump and for then Vice President Kamala Harris, as well schematics allegedly stolen from the U.S. National Security Agency (NSA).

Wagenius is set to be sentenced on September 3, 2026. The government says he faces a maximum penalty of 20 years in prison for conspiracy to commit wire fraud, a maximum penalty of five years in prison for extortion in relation to computer fraud, and a mandatory two-year sentence consecutive to any other prison time for aggravated identity theft.

The third alleged co-conspirator is John Erin Binns, 26, an elusive American man who fled the United States after being indicted for his admitted role in a 2021 breach at T-Mobile that exposed the personal information of at least 76 million customers.

Sources close to the investigation said Binns, also known as “IRDev” and “IntelSecrets,” was until recently incarcerated in a Turkish prison, but that he has since been released and has resurfaced online. Those sources said Binns also recently obtained Turkish citizenship, and under Turkish law a citizen cannot be extradited to a foreign country.

An image of a passport that Binns shared in an email to KrebsOnSecurity in Feb. 2023.

Moucka pleaded guilty to four criminal counts, including computer fraud, wire fraud, aggravated identity theft, and conspiracy. He is slated to be sentenced on Oct. 27 and faces a mandatory minimum penalty of two years in prison on the aggravated identity theft count, as well as a maximum penalty of 30 years in prison on the remaining counts. Ultimately, it will be up the federal judge how much time Moucka actually serves for his extensive cybercriminal rap sheet.

For an interview with Moucka prior to his arrest and a deeper look at Binns, see our original report on Moucka’s arrest.