ASOS confirms social-engineering root cause in October breach

ASOS told customers the breach disclosed October 6 began with a social engineering attack on an employee, not a compromise of its Snowflake environment as the attacker claimed. An unauthorized party impersonated a trusted contact to steal login credentials, then pulled data from third-party platforms ASOS uses. The group calling itself Xuanye Group publicized the breach via hijacked in-app push notifications. Exposed data includes names, contact details, and recent search histories; no payment card details or passwords were taken.

Sources: cosmicbytez.ca and rescana.com