INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Asos App Exposes User Data to Potential Hackers

| 2026-10-06 11:51 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
On October 6, 2026, Asos customers received a rogue app notification claiming the online clothing retailer's Snowflake instance had been compromised and threatening to leak data. The attackers allegedly sent this message via Telegram channel "Xuanye Wen Gateway" with an ultimatum of "Engage with us, or we will leak it." Several hours later, Asos confirmed the attack, stating that basic personal information including name and contact details may have been accessed, but payment-card information and account passwords were not impacted. The incident has limited impact on Asos's operations, with its website and app operating normally; however, its share price initially fell by around 12 percent before recovering slightly.
Technical Mitigations AI-generated
• Account Use Policies (ATT&CK mitigation for Social Engineering): Adds verification for helpdesk resets, approvals, and app consents commonly targeted by impersonation. • Audit (ATT&CK mitigation for Social Engineering): Enables correlation of email/identity/SaaS/endpoint activity that appears legitimate. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA retailretail
Incident Timeline
‎2026/10/06
Asos's Snowflake instance was targeted in a data theft campaign, prompting a rogue notification claiming the instance had been compromised.
organisation Asos
Asos app delivers a data leak threat instead of fast fashion.
organisation Telegram
The notification included a link to a Telegram channel named "Xuanye Wen Gateway" and addressed Asos's data protection officer and IT team.
organisation Snowflake
"Dear ASOS DPO and IT, we have fully compromised the Snowflake instance.
organisation Register
Several hours after publication, an Asos spokesperson confirmed the attack and claimed it had limited impact, telling The Register, " Basic personal information including name and contact details may have been accessed.
organisation Customers of Snowflake
Customers of Snowflake, a cloud platform for storing and analyzing data, were targeted in a major data theft campaign in 2024, including Ticketmaster, Santander, AT&T, and dozens of others.
organisation Ticketmaster, Santander
Customers of Snowflake, a cloud platform for storing and analyzing data, were targeted in a major data theft campaign in 2024, including Ticketmaster, Santander, AT&T, and dozens of others.
organisation AT&T
Customers of Snowflake, a cloud platform for storing and analyzing data, were targeted in a major data theft campaign in 2024, including Ticketmaster, Santander, AT&T, and dozens of others.
victims 165 organizations
Connor Riley Moucka, 26, of Kitchener, Ontario, later pleaded guilty to computer fraud, wire fraud, aggravated identity theft , and conspiracy charges over a hacking spree that compromised more than 165 organizations, exposed billions of customer records, and brought in about $2.5 million in ransom payments.
financial $2.5 records
Connor Riley Moucka, 26, of Kitchener, Ontario, later pleaded guilty to computer fraud, wire fraud, aggravated identity theft , and conspiracy charges over a hacking spree that compromised more than 165 organizations, exposed billions of customer records, and brought in about $2.5 million in ransom payments.
‎October 7
Threat actors exploited a vulnerability in the Asos app to deliver a data leak threat on October 7, 0845 UTC.
general_metric 0845 October
Updated October 7 0845 UTC : To add Snowflake's statement.
‎October 9
Asos's mobile app delivered a data leak threat to its customers instead of the intended fast fashion content.
organisation Asos
" ® Updated October 9 0900 UTC to add:  Snowflake said in a statement: “We are aware of ASOS’s notification to their customers regarding this incident.
organisation UTC
" ® Updated October 9 0900 UTC to add:  Snowflake said in a statement: “We are aware of ASOS’s notification to their customers regarding this incident.
Tactical Metrics
Metrics
victims
165
Organizations
Connor Riley Moucka, 26, of Kitchener, Ontario, later pleaded guilty to computer fraud, wire fraud, aggravated identity theft , and conspiracy charges over a hacking spree that compromised more than 165 organizations, exposed billions of customer records, and brought in about $2.5 million in ransom payments.
Metrics
financial
2,500,000
Financial Impact / Stolen Funds
Connor Riley Moucka, 26, of Kitchener, Ontario, later pleaded guilty to computer fraud, wire fraud, aggravated identity theft , and conspiracy charges over a hacking spree that compromised more than 165 organizations, exposed billions of customer records, and brought in about $2.5 million in ransom payments.
Intelligence Sources
The Register - CSO 2026-10-06