ASOS Confirms Data Breach Linked to Stolen Employee Credentials

ASOS disclosed an October 6 breach in which an attacker impersonated a trusted contact to steal an employee's credentials and access third-party customer-communication platforms (potentially a Simon AI instance), enabling the actor to send convincing push notifications and post a Telegram link. The threat actor claims to possess customer personal data — including names, addresses, emails, phone numbers, customer IDs and site search history — while ASOS says payment data was not affected and investigations continue.