Hackers Hijacked ASOS’s Own App to Message Customers: The AI Marketing Platform Risk Every Brand Now Has (AI Trends, 12 October 2026)

What’s trending in AI on 12 October 2026: The breach retail security teams are dissecting this week did not start with malware or a zero-day. It started with a convincing message to one employee. On Tuesday, 6 October, customers of the online fashion retailer ASOS opened their phones to a push notification sent through the company’s own app, addressed to its data protection officer and IT team and claiming that the attackers had “fully compromised the Snowflake instance”. Within days, ASOS confirmed an intruder had posed as a trusted contact to obtain an employee’s login, then used it to reach third-party platforms the company uses to talk to customers. The group behind it says the doorway was Simon AI, an “agentic marketing” platform that builds customer profiles on top of ASOS’s data. That claim is not confirmed, but the lesson already is: the AI tools marketing teams buy to personalise every message are now a direct line to your entire customer base, and too few companies secure them that way. Below: what happened, what is confirmed and what is only claimed, why AI marketing stacks are such a tempting target, and a stage-by-stage plan to break the same attack chain in your business.

Key takeaways

One phished login, millions of inboxes. ASOS says a stolen employee credential opened third-party customer-communication platforms, and the attacker used them to push an extortion message to app users.
The AI layer is the claimed entry point. The attackers told the BBC they got in through Simon AI, an agentic marketing platform built on Snowflake that ASOS uses for personalisation. Neither ASOS nor independent researchers have confirmed it.
Snowflake says it was not breached. The company says no vulnerability, flaw or misconfiguration in its platform was involved and its customers need no remediation.
Personalisation data is breach data. Samples shared with the BBC reportedly include names, addresses, phone numbers, customer numbers and search histories, far more than “basic contact details”.
Treat martech as critical infrastructure. Any login that can message your whole customer base or export behavioural profiles deserves the same controls as a finance or admin account.

The attackers did not need to break the storefront. They borrowed the retailer’s own voice.

1. What happened at ASOS, day by day

ASOS serves roughly 17 million customers across about 150 markets. At around 10 a.m. UK time on Tuesday, 6 October, some of its app users received a notification that looked like any other marketing message, except for the wording. Signed “xuanyewengateway” and pointing to a Telegram channel, it told ASOS to engage with the sender or see its data leaked. Group-IB researcher Anastasia Tikhonova told Infosecurity Magazine the channel had been created that same day, from an account previously used for trading gaming items.

Later on 6 October, ASOS said it was investigating unauthorised activity on third-party platforms it uses to communicate with customers, restricted access to its notification tools and began working with specialist advisers and authorities. Its shares fell sharply that day, by as much as 13% according to Dark Reading, before recovering about half the loss over the following days.

On Thursday, 8 October, after roughly 48 hours of investigation with outside experts, ASOS emailed customers with the cause. An unauthorised party had gained access to an employee account by impersonating a trusted contact to obtain login credentials, then used those credentials to reach information held on certain third-party platforms. ASOS said names, contact details and some non-personal account information were affected, and that it does not believe payment card details or account passwords were accessed. The same day, the BBC reported that a data sample sent by the group contained considerably more than that.

Four of the five steps are confirmed. The one that is not, the AI marketing layer, is the one every brand should check first.

2. Confirmed, claimed and denied: sorting the facts

Breach coverage moves fast and mixes the victim’s statements with the attacker’s boasts. Here is where each key claim stands as of this weekend.

Claim	Who says so	Status
Unauthorised push notifications were sent to some app users on 6 October	ASOS	Confirmed
Entry came from an employee tricked by someone impersonating a trusted contact	ASOS customer notice, 8 October	Confirmed
Names, contact details and non-personal account information were accessed	ASOS	Confirmed
Addresses, phone numbers, emails, customer numbers and website search terms were taken	Data sample sent to the BBC	Reported; scope not independently verified
Payment card details and account passwords were not accessed	ASOS; the group also says payments were untouched	Company’s current belief
A Simon AI instance was the route to customer data	The attackers, speaking to the BBC	Unconfirmed
The Snowflake instance was “fully compromised”	The attackers’ push notification	Denied by Snowflake
A July incident affecting about 140,000 ASOS US accounts is linked	Earlier reporting	Check Point believes it is unrelated

Status as reported by Computer Weekly, Infosecurity Magazine, Dark Reading and em360tech, 6 to 9 October 2026. Delana’s summary.

Snowflake’s statement is precise. A spokesperson said the incident did not result from any vulnerability, weakness, flaw or misconfiguration in its platform, and that its customers do not need to take any remediation steps. That matters, because Snowflake’s name carries baggage: in 2024, criminals used stolen credentials to raid customer accounts that lacked multi-factor authentication. The pattern this time looks similar in one respect only. The weak point was a person and a login, not the database.

The UK Information Commissioner’s Office has also published guidance for affected customers, urging them to stay alert to unexpected messages, avoid links and attachments, log in only through official channels and keep an eye on bank accounts. ASOS says it is working with law enforcement and the relevant regulators.

3. Why an “agentic marketing” platform is such a rich target

Monetate, a personalisation and experimentation vendor, announced on 30 July 2026 that it was acquiring Simon AI, which it described as an AI-first composable customer data platform. According to Simon AI’s own ASOS case study, as summarised by The Interline, the architecture has three layers: Snowflake holds the data, Simon AI builds the segments and profiles, and Braze sends the campaigns. Malwarebytes researcher Pieter Arntz notes that ASOS uses this setup to trigger customer communications, including push notifications, and that profiles in tools like these typically include browsing and purchase history, demographics and segment labels. Infosecurity Magazine reports the platform is built on Snowflake’s Cortex AI services.

Put those pieces together and you can see why an attacker would aim here rather than at the shop itself. A single platform that can read rich behavioural profiles and act on them by messaging customers combines the two things extortionists want most: data to threaten with and a trusted channel to apply pressure through. The Interline puts it plainly: by all accounts the attack was not AI-assisted, but the systems involved are agentic. The AI is not the attacker. It is the high-value asset.

Personalisation stacks are designed so one team can see everything and reach everyone. That is exactly the property an attacker wants.

There is also an ownership gap. Dark Reading points out that marketing and notification platforms are often bought and run by business teams, so security may never be involved in their setup, and they are rarely monitored closely. Logins can be broad enough for one account to message the entire customer base with no second approval and no alert. That is the same blind spot we described in our look at shadow AI: tools adopted outside IT’s line of sight end up holding the most sensitive data. And because these platforms connect to one another through APIs and tokens, the risk echoes the SaaS supply chain and OAuth attacks that hit Salesforce and Google Workspace customers in 2025.

4. The new extortion play: hijack the brand’s voice

What made ASOS a headline was not the volume of data. No figure for affected customers has been published. It was the delivery. Huntress’s Muhammad Yahya Patel told em360tech the attackers used ASOS’s own channels to reach its customers, a serious loss of operational control. Talion’s Natalie Page called it a typical extortion tactic and expects a ransom demand to follow.

Sending the threat to customers instead of only to the company changes the pressure. Executives no longer control the timing of disclosure, the share price reacts within hours, and every customer becomes a potential phishing target for follow-on scams that cite the breach. Check Point advised shoppers to treat ASOS-branded messages with suspicion for a while for exactly that reason. It is the same logic as the help-desk and trusted-contact tricks we covered in how social engineering is outsmarting tech defenses, scaled up from one victim to millions.

It is also part of a pattern this month. In Denmark, data on about 8.8 million people in the national CPR register was exposed after attackers abused a legitimate company’s access, with one account reportedly protected by the password “123456”. The common thread is access that was legitimately granted and then borrowed. For how little time defenders now have once someone is inside, see our breakdown of Microsoft’s 2026 Digital Defense Report.

Search terms are the telling item. They exist because of personalisation, and they reveal more about a person than an address does.

5. Personalisation data is a liability you chose to keep

Retailers collect search histories, size preferences and browsing trails because AI personalisation turns them into revenue. Simon AI’s case study credits its work with creating $77.5 million in incremental revenue for ASOS, according to The Interline. The same data becomes a liability the moment it leaves. A leaked address is a nuisance; a leaked record of what someone searched for, matched to their name, can be embarrassing, and is ideal raw material for tailored phishing.

The Interline makes a sharper point: behavioural signals also go stale. Shoppers change size, taste and circumstances, so years-old profile data can be both risky and wrong. The privacy debate we covered in AI-set prices and the new surveillance-pricing laws is heading the same way: regulators increasingly ask not just whether data was protected, but why it was kept at all. Data minimisation is no longer only a compliance line. It is the cheapest way to shrink the payout an extortionist can demand.

6. Break the chain: a stage-by-stage plan with owners

Every step in the ASOS chain was a point where a control could have stopped it. Use the plan below to map each stage to an action, a named owner and a deadline. It works for any business that uses an AI marketing, CRM or customer-messaging platform, from a five-person online shop to a global brand.

Stage 1, impersonation. Action: verify “trusted contacts” out of band. Any request from a partner, agency or vendor to share credentials, approve a login or reset MFA gets a call back on a number already on file. Owner: security awareness lead. Deadline: brief marketing and agency-facing teams this week.
Stage 2, credentials. Action: phishing-resistant MFA and SSO on every martech tool. Put the AI personalisation platform, CDP, email and push tools behind your single sign-on with passkeys or security keys, and remove local passwords. Owner: identity team. Deadline: 30 days. Our guide to credential and identity theft explains why SMS codes are not enough.
Stage 3, third-party reach. Action: inventory and shrink access. List every platform that can read customer data or message customers, who has accounts, and which API keys and service connections link them. Remove leavers, agency accounts that are no longer needed and admin rights that are not used. Owner: marketing operations with security. Deadline: 30 days, then quarterly.
Stage 4, the AI layer. Action: treat the agent as a privileged identity. Give the personalisation platform read access only to the fields it needs, keep identifiers and raw search histories out of it where possible, and log its queries and exports somewhere it cannot edit. Ask the vendor how its agents are permissioned, as covered in our “Allow Always” agent permissions explainer. Owner: data protection officer. Deadline: before the next contract renewal.
Stage 5, broadcast. Action: put a second key on mass messages. Require two-person approval for any campaign sent to more than a set share of customers, alert security on unusual sends, and keep a tested “kill switch” that pauses all outbound push, email and SMS within minutes. Owner: head of CRM. Deadline: 14 days.
Stage 6, response. Action: pre-write the customer message. Draft a holding statement, a phishing warning for customers and a regulator notification template now, so you are not writing them while the attacker controls your channel. Owner: communications lead with legal. Deadline: 30 days.

If you only have time for one fix this month, make it the kill switch. It turns a public crisis into a contained incident.

Arctic Wolf’s Justin Moore summed up the strategic shift for Dark Reading: organisations should treat customer communications platforms as part of their critical security infrastructure. Check Point’s Aaron Rose framed the practical test: look at how far a single stolen login can reach. If the honest answer is “every customer we have”, the plan above belongs on this quarter’s agenda.

7. What remains unknown

The true scope. ASOS has not published how many customers were affected, and the BBC did not say whether experts verified the attackers’ sample.
The Simon AI link. Only the attackers have named it. Monetate was approached for comment by Infosecurity Magazine; we found no public statement from Simon AI or Monetate addressing the claim as of Monday morning.
Who the attackers are. The group, styled Xuanye or Xuanyewen, appears to be new. Reports that it is based in China are unconfirmed.
What comes next. The group said the data would not be touched for two weeks. Expect a ransom demand, a leak, or both, and expect copycat phishing aimed at ASOS customers in the meantime.

One more point for anyone deploying AI agents with their own accounts and inboxes, a trend we tracked in Google’s Gemini agent getting a Workspace account. The more an AI tool can do on its own, the more valuable its credentials become. ASOS shows that attackers already know where those credentials live.

Frequently asked questions

What happened in the ASOS data breach?

On 6 October 2026, attackers sent an extortion message to ASOS app users through the retailer’s own push notifications. ASOS says an intruder impersonated a trusted contact to obtain an employee’s login, then used it to access third-party platforms the company uses to communicate with customers. Names, contact details and some account information were accessed.

Was Simon AI hacked?

The attackers told the BBC that a Simon AI instance, an agentic marketing platform built on Snowflake that ASOS uses for personalisation, was compromised. ASOS and independent researchers have not confirmed this, and the exact path to the data has not been published.

Was Snowflake breached?

Snowflake says no. A spokesperson said the incident did not result from any vulnerability, weakness, flaw or misconfiguration in its platform, and that Snowflake customers do not need to take remediation steps.

Were ASOS payment details or passwords stolen?

ASOS says it does not believe payment card information or account passwords were accessed. Customers should still be wary of unexpected emails, texts or calls that mention the breach, log in only through the official app or website, and watch their bank statements, as the UK ICO advises.

Why are AI marketing platforms a security risk?

They combine rich behavioural customer profiles with the ability to message every customer in the brand’s name. They are often bought and run by marketing teams without security involvement, and a single login can reach both the data and the channel, so one phished credential can become a company-wide incident.

How can a business protect its customer messaging platforms?

Put every marketing and messaging tool behind single sign-on with phishing-resistant MFA, inventory who and what can access customer data, limit the AI layer to the fields it needs, require two-person approval for mass sends, keep a tested kill switch for outbound messages and verify any credential request from a “trusted contact” by calling back on a known number.

Bottom line: The ASOS incident is less about one retailer than about where AI has quietly concentrated risk. Personalisation platforms now hold the richest customer data a company owns and the power to speak to every customer at once. If marketing owns the tool and nobody owns its security, the next extortion notice could arrive in your customers’ pockets, signed with your logo.

Delana Technologies