Asos Hacked: The Digital Footprint of a Cyberattack

A sudden spike to 32 times the average number of mentions

On 6 October, ASOS customers received an unauthorised push notification warning that the online fashion retailer had been hacked. The message, which linked to a Telegram channel operated by a group calling itself Xuanye Group, claimed that the attackers had compromised company data. ASOS subsequently confirmed that an unauthorised party had obtained an employee's login credentials through impersonation and accessed information on third-party platforms, exposing some customer details, including names and contact information.

Before the incident, online discussion around ASOS averaged approximately 250 mentions per day. On 6 October, that figure climbed to almost 8,000, representing an increase of around 32 times the usual daily volume. Over the course of a week, the subject generated approximately 12,000 tweets, illustrating the scale of attention directed towards the incident.

From a data breach to a wider conversation about cybersecurity

The hashtags associated with the ASOS incident offer another perspective on how the conversation developed. Among the most popular were #cyberattack, #databreach, #onlinesafety and #computerforensics. These terms place the incident within a broader cybersecurity discussion, extending beyond the brand itself to questions of data security, online safety and digital investigation.

For OSINT analysts, identifying these recurring terms is a starting point rather than an end in itself. Examining the posts behind them can help distinguish news reporting from first-hand accounts, security advice, unverified claims and speculation about the extent of a breach.

The conversation continued after the initial spike

Although online activity declined from its peak, it did not immediately return to its previous level. In the aftermath of the attack, discussion remained at around 400 posts per day. This is approximately 60% above the pre-incident baseline, suggesting that the incident continued to generate attention after the initial surge.

For cyber threat intelligence teams, this continued activity is an important reason to maintain monitoring beyond the first wave of reports. New claims may emerge, information may be recirculated and the discussion may shift as further details become public. Tracking these changes can help analysts identify developments that warrant closer examination. It can also reveal which aspects of an incident continue to attract attention and where new information might enter the public conversation.

What sentiment can tell us about the impact of a cyberattack

The incident also coincided with a marked change in the sentiment of the online conversation around ASOS. Before the attack, negative sentiment accounted for approximately 11% of mentions. During and after the incident, this share rose to 45%, an increase of 34 percentage points.

While sentiment analysis cannot establish the technical severity of a cyberattack, it can provide additional context about how the incident is being received publicly. Combined with topic analysis and the evolution of discussion over time, it helps distinguish a short-lived burst of attention from a conversation that continues to evolve.

How social listening helps track cyberattacks in real time

The incident highlights how social listening can help organisations track the evolution of a cyberattack beyond the initial breach. By monitoring online conversations in real time, security and intelligence teams can identify sudden spikes in activity, follow emerging discussions and understand how information about an incident spreads across platforms. In the case of ASOS, Visibrain data offers a closer look at how the conversation unfolded, from the initial surge in mentions to the continued discussion in the days that followed.