Xuanye Group (Threat actor): news timeline & CVEs

ASOS: Hackers tricked way into employee account before sending rogue push notification

ASOS says attackers impersonated a trusted contact, hijacked an employee account, and accessed some customer contact data.

British retailer ASOS said attackers impersonated a trusted contact, took over an employee account, and used those credentials on third-party platforms before sending a rogue app push notification. The company said names, contact details, and some non-personal account data were accessed, but not payment cards or passwords, and it did not say how many customers were affected or whether data was copied out. A previously little-known group, Xuanye Group, claimed it hit ASOS’s Snowflake environment and the Simon AI service; Snowflake denied a breach, and the group has not publicly posted data samples. ASOS shares fell more than 10% after the alert.

The Record16:57 UTC · 3h agoData breach in the wild 18 sources

Asos confirms breach of customer data after hackers send rogue app notification

Asos confirmed hackers stole customer contact data from a Snowflake platform and sent a rogue app notification.

UK retailer Asos told the London Stock Exchange that attackers accessed a third-party platform used to communicate with customers and stole names and contact information. BBC reporting says the data also includes home addresses, phone numbers, email addresses, and profile notes such as website search queries. The intruders, calling themselves Xuanye Group, sent an unauthorized in-app notice saying data hosted on Snowflake was compromised and demanding engagement or they would leak it. Reports say they obtained login credentials by impersonating a trusted contact; Snowflake said its own systems were not breached, and the number of stolen records is unknown.

TechCrunch · Securityupdated 16:57 UTC · 3h agofirst 15:01 UTC · 5h agoData breach 18 sources

ASOS Confirms Data Breach Linked to Stolen Employee Credentials

ASOS confirmed attackers used stolen employee credentials to access customer account data via third-party platforms.

UK retailer ASOS told customers on October 8 that personal and account data was accessed in an October 6 breach. The attacker impersonated a trusted contact to steal an employee’s credentials, then used them on third-party customer platforms and sent a push notification claiming a Snowflake compromise. ASOS said payment data was not taken and operations continued; Snowflake said its platform was not compromised. Actor Xuanye Group told the BBC a Simon AI instance was the access path, and a sample reportedly included names, contact details, customer numbers, and search history.

Infosecurity Magazineupdated 16:57 UTC · 3h agofirst 13:36 UTC · 7h agoData breach in the wild 18 sources

ASOS links data breach to social engineering attack, credential theft

ASOS says social engineering stole employee credentials and exposed customer names and contact details.

UK fashion retailer ASOS confirmed that attackers impersonated a trusted contact, stole an employee’s login credentials, and used them to access information on third-party platforms. Exposed data includes full names, contact details, and some non-personal account information; ASOS said payment card data and account passwords were not accessed. A group calling itself Xuanye Group sent malicious in-app push notifications claiming customer data theft. ASOS locked down the platforms and is investigating with outside experts, law enforcement, and regulators; the number of affected customers has not been disclosed.

BleepingComputerupdated 16:57 UTC · 3h agofirst 11:42 UTC · 8h agoData breach 18 sources

ASOS Confirms Cyberattack, Data Breach

ASOS confirmed a third-party notification platform was hacked, potentially exposing customer names and contact details.

British online retailer ASOS told the London Stock Exchange that attackers compromised a third-party customer-communication platform and pushed unauthorized app notifications. The messages claimed ASOS’s Snowflake instance was fully compromised and threatened to leak data unless the company engaged. ASOS said names and contact details may have been accessed, but not payment-card data or passwords, and that its website, app, and operations were not disrupted. A group calling itself Xuanye Group claimed the incident on Telegram; researchers said that claim is unconfirmed and could be a false flag.

SecurityWeekupdated 16:57 UTC · 3h agofirst Oct 7, 09:46 UTC · 1d agoData breach in the wild 18 sources1· 1 read

ASOS confirms data breach after “HACKED” in-app notifications

ASOS confirmed a breach after hackers pushed HACKED alerts via its app claiming a Snowflake theft.

UK fashion retailer ASOS confirmed that third-party customer communication platforms were accessed without authorization after attackers sent “ASOS HACKED” push notifications through the official mobile app around 5:00 a.m. ET Tuesday. The alerts, reported by many customers, told ASOS to contact a Telegram channel run by a group calling itself “Xuanye group” and claimed the company’s Snowflake instance was fully compromised. ASOS says names and contact details may have been exposed, does not believe payment cards or passwords were affected, and has not confirmed the Snowflake claim or how many customers were impacted. The group later said it stole customer information but gave no evidence or volume.

BleepingComputerupdated 16:57 UTC · 3h agofirst Oct 6, 16:33 UTC · 2d agoData breach in the wild 18 sources

ASOS “hackers” send push notifications to customers

ASOS customers got in-app alerts claiming hackers fully compromised Snowflake and threatening to leak data.

Thousands of ASOS customers received an in-app push notification addressed to the retailer's data protection and IT teams, claiming the company's Snowflake instance was fully compromised and threatening a leak unless ASOS engages. ASOS uses Simon AI, which runs on Snowflake, with Braze to personalize pushes, so abuse of that channel is plausible, but the Snowflake theft is not confirmed. A group calling itself Xuanye said payment data was unaffected, an unverified claim, while an ASOS representative told Sky News the alert was fraudulent and under investigation. There is no verified evidence that customer databases, payment cards, or passwords were stolen.

Malwarebytes Labsupdated 16:57 UTC · 3h agofirst Oct 6, 14:11 UTC · 2d agoData breach 18 sources

ASOS app users receive push notifications apparently sent by hackers

ASOS app users got hacker alerts from new Xuanye Group claiming a Snowflake compromise.

BBC reports that dozens of ASOS app users received a push notification addressed to the company's data protection officer and IT team, claiming hackers had fully compromised a Snowflake instance. The message links to a Telegram channel created the same day by a new group calling itself Xuanye Group, which has posted only three times. It is not confirmed that ASOS is a Snowflake customer or what data, if any, is stored there. Horizon3 said notification access is separate from Snowflake and, if both claims hold, suggests credentials opened more than one system.

Hacker News · securityupdated 16:57 UTC · 3h agofirst Oct 6, 10:15 UTC · 2d agoData breach 18 sources HN 22↑ · 7 comments

Shares in British clothing company ASOS dive after hackers apparently send push notification

ASOS shares fell over 10% after an unconfirmed app alert claimed hackers compromised its Snowflake data environment.

Shares in British online retailer ASOS fell more than 10% on Tuesday after customers received an app push notification titled "ASOS HACKED," claiming the company's Snowflake instance was fully compromised and demanding contact or a leak. The alert linked to a Telegram channel calling itself Xuanye Group, a name extortion trackers had not previously seen, which later said payment information was unaffected without providing evidence. No customer-data samples were posted, and there is no public evidence that ASOS uses Snowflake to send push notifications. ASOS did not comment; the only indication of access is that the message appeared inside the company's app.

The Recordupdated 16:57 UTC · 3h agofirst Oct 6, 04:00 UTC · 2d agoData breach 18 sources1

Xuanye Group

Timeline9 articles

Appears with