On Tuesday morning, shoppers in several countries got a scary message on their phone, sent through the Asos shopping app. It said the company had been hacked. It was written by the people who had done it.
What actually happened
Asos is a British online clothes shop with around 17 million customers a year, and its app is on more than ten million Android phones.
At about eleven in the morning on 6 October, the app pushed a notification to those phones. Screens lit up with the words “ASOS HACKED”. But the message was not written for shoppers. It began: “Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.” A link led to a chat channel run by a group calling itself Xuanye.
That is a ransom note, meant for the company’s data protection officer and its computer department. It landed on ordinary customers’ phones instead, and Asos shares fell by about a tenth that morning.
Asos blocked the attackers the same day and apologised. Two days later it explained how the break-in had started: someone pretending to be a trusted contact had talked an Asos employee into handing over a login. With that one login, the criminals reached the outside services Asos uses to speak to its shoppers.
Then the picture got worse. On Wednesday night the criminals sent the BBC a sample of what they had taken: names, home addresses, phone numbers, email addresses, customer numbers, dates of birth — and the searches people had typed on the site, such as “reclaimed vintage” and “glamorous wide fit”. Payment card numbers and passwords were not taken.
Why this matters to you
The first lesson here is about trust. A message that pops up in an app you installed is not proof that the company sent it. The criminals did not build a fake Asos app. They borrowed the real one: they stole the login that lets Asos send notifications, and used Asos’s own system to deliver their demand. One security expert described it as turning the shop’s own app into its ransom note.
The second lesson is about what is now in a stranger’s hands. Names, addresses, phone numbers, dates of birth and shopping searches cannot be cancelled the way a bank card can. They stay out there.
None of those details, on its own, lets anyone take your money. Together they are the raw material for a convincing lie. A message that greets you by name and mentions a real order is far harder to brush off than one addressed to “Dear Customer”. Security experts told shoppers to expect exactly that: messages written for you.
What you can actually do
None of this needs new software or a technical background — only a few small habits.
- If the “ASOS HACKED” message is still on your phone, do not tap the link. Clear the message.
- For news from Asos, type asos.com into your browser yourself rather than following a link.
- Change your Asos password, then change it anywhere else you used it. One password everywhere is one key for your home, your car and your bank.
- Switch on two-step verification for your email first, then your bank. It means that after your password you also type a short code sent to your phone, so a stolen password alone is not enough. Your email matters most: whoever can read it can reset every other password.
- Treat any message offering a refund or compensation for the hack as a scam. A real company never needs your card details to send you money.
- Check your bank and card statements for small, unfamiliar charges. Card fraud often starts with a tiny test payment before a large one.
Common misunderstandings
Myth: my phone has been hacked
The message appeared in your pocket, so it is easy to assume the phone itself was broken into. That is not what happened: a notification arriving on your phone does not mean anyone got into it. The criminals reached the shop’s systems, not yours.
Myth: they didn’t take my card, so there is nothing to worry about
Card numbers are the easy part. A bank can cancel a card and send a new one within a week. Your name, address, date of birth and the things you searched for cannot be reissued. That is exactly why they are worth stealing — they make the next message believable.
Myth: only careless people fall for this
The employee who handed over the login was not careless. Someone they had good reason to trust asked, and asked convincingly. This kind of attack is aimed at people, not machines.
What to watch for next
Asos says it will write to customers directly if it believes they need to act, and it has warned that it will never ask for a password, a security code or payment details in a message it starts.
Expect criminals to use the news as their excuse. The likely messages are a warning that your account needs verifying, an offer of a refund, or a claim that an unauthorised order must be confirmed with your card details. The more real details a message contains, the more careful you should be — not less.
Expect the same pattern elsewhere, too. A breach rarely looks dramatic from the customer’s side: nothing goes missing on the day, and the expensive part arrives weeks later.
The one thing to remember
A message is not true because it arrived in a real app. What was stolen this week cannot be taken back, but it can be made useless: a different password for every important account, a code on your email, and a healthy suspicion of any unexpected message about this hack.
Image: “Smartphone screen with notification icons” by Jay Openiano via Unsplash, used under the Unsplash License.