Hackers claimed they reached Asos customer data by breaching the Snowflake-connected Simon AI marketing tool
Fast-fashion retailer Asos confirmed a breach in which customers' basic personal information, including names and contact details, may have been accessed. The threat actor, calling itself Xuanye Group, claimed to the BBC that it got in by breaching Simon AI, a third-party AI marketing tool from Monetate that Asos uses on top of its Snowflake instance, and hijacked the Asos app to push an 'ASOS HACKED' extortion message. Asos said an employee was tricked into giving up legitimate credentials, which were used to access certain third-party platforms. A security expert said Simon AI accounts did not require multifactor authentication and called this the route into Asos.
What the AI did
Simon AI is a third-party AI marketing tool from Monetate that Asos runs on top of its Snowflake data warehouse. It is alleged to have been the way the attackers reached Asos customer data. The attackers claimed to have breached it, and a security expert said its accounts did not require multifactor authentication.
First reported October 9, 2026 · Added to the register October 18, 2026 · 1 source
- Developer
- Monetate
- Deployer
- Asos
- Model
- Simon AI
- Affected
- Asos customers in Great Britain, Ireland, the United States and elsewhere
- Country
- United Kingdom
- When it happened
- Not stated in the sources
- First reported
- October 9, 2026
What this means for you
Could this affect you?
Asos customers in Great Britain, Ireland, the United States and other countries may have had their names and contact details accessed, and other organisations using Simon AI without multifactor authentication may face the same risk.
What to check
- Turn on multifactor authentication for every third-party AI and marketing tool connected to data warehouses such as Snowflake.
- Check infostealer logs, the collections of passwords stolen by malicious software, for your organisation's exposed credentials.
- Train staff to recognise social-engineering attempts aimed at obtaining access credentials.
Areas of your AI programme this touches
Every fact and its source (4)
- Data Asos confirmed may have been accessedNames and contact details“basic personal information including name and contact details may have been accessed”[1]
- Initial access method per AsosEmployee tricked into giving up credentials“attacker tricking an employee into believing they were a legitimate contact”[1]
- Security weakness cited by expertSimon AI did not require MFA“doesn't require MFA for accounts, has one common login portal”[1]
- Extortion message in Asos appAttackers claimed full compromise of Snowflake instance“We have fully compromised the Snowflake instance”[1]
Sources
- Asos Hackers Claim Breach of Snowflake-Connected Simon AIgovinfosecurity.com · October 9, 2026
How this record is classified. Severity S (4/5): real harm to one organisation, data exposed, or a containment failure. OECD level: incident, an event in which an AI system led to actual harm. Evidence: Alleged, meaning one party's claim.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
