ASOS Discloses Breach After Hackers Leverage Stolen Staff Credentials via Simon AI Platform

Online fashion retailer ASOS has confirmed that a recent cyber‑attack compromised customer data after attackers obtained valid employee login details. The breach was traced to a vulnerability in Simon AI, an external marketing automation service that the company uses to target shoppers.

According to the information first reported by Infosecurity Magazine, the perpetrators infiltrated Simon AI’s systems and extracted credentials belonging to ASOS staff members. Using those legitimate accounts, the hackers were able to bypass the retailer’s internal defenses and access databases that store personal information, including names, email addresses and purchase histories.

ASOS said the incident was identified during a routine security audit and that the compromised data does not appear to include payment card numbers or other highly sensitive financial details. Nonetheless, the company has warned affected users to be vigilant for phishing attempts and has offered a free year of identity‑theft monitoring to those whose information was exposed.

The breach highlights the growing risk associated with third‑party vendors that handle large volumes of consumer data. While ASOS maintains that its own security protocols remain robust, the reliance on an external platform for marketing automation created a pathway for attackers to reach internal systems. Industry analysts note that supply‑chain attacks have risen sharply in recent years, prompting many firms to reassess how they vet and monitor the security posture of their partners.

ASOS has launched an internal investigation and is working with law enforcement and cybersecurity experts to determine the full extent of the intrusion. The retailer also indicated that it will accelerate plans to enhance multi‑factor authentication and tighten access controls for all external services. As the fashion e‑commerce sector continues to grow, the incident serves as a reminder that even well‑known brands are vulnerable when third‑party tools are compromised.