ASOS Confirms Possible Data Exposure After Hackers Send Threatening App Alerts
Introduction
In an era where digital storefronts are as vital as physical ones, a cyberattack on a major retailer sends shockwaves far beyond the boardroom. On October 6, 2026, ASOS, the British online fashion giant, became the latest high-profile target of a brazen cyber intrusion. The incident was not a silent data heist discovered months later, but a loud, threatening alert pushed directly to customers’ phones through the company’s own app.
The unauthorized notification, headlined “ASOS HACKED,” claimed a full compromise of the retailer’s Snowflake data environment and threatened to leak stolen information unless the company engaged with the attackers. While ASOS has confirmed that basic personal information may have been exposed, the full scope of the breach remains a subject of intense investigation.
The Attack: How a Shopping App Became a Ransom Note
The unsettling notification arrived at around 10:00 AM BST on Tuesday, October 6, 2026, landing on the smartphones of ASOS app users across the UK, Australia, France, Sweden, and Ireland. It was not a typical marketing alert. The message was addressed directly to ASOS’s Data Protection Officer and IT teams.
“Dear Asos DPO and IT, we have fully compromised the Snowflake instance,” the notification read. “Engage with us, or we will leak it.”
The message included a link to a Telegram channel belonging to a previously unknown group calling itself the “Xuanye Group”. This group later posted claims that payment information was not affected and that the ASOS app was “safe to use,” while asserting that customer data was “safe on our server” and would not be touched for a “designated period”. Asos customers were left bewildered and concerned; some initially mistook the alert for a bizarre promotional campaign before realizing its sinister nature.
ASOS’s Response and Confirmed Impact
ASOS responded swiftly to the incident, acknowledging the “unauthorised customer notification” and launching an investigation into “unauthorised activity involving third-party platforms that we use to communicate with customers”.
The company took immediate action to restrict access to the compromised notification platform and engaged internal and external cybersecurity specialists, as well as relevant authorities like the National Cyber Security Centre (NCSC).
In its official statement, ASOS confirmed that “basic personal information including name and contact details may have been accessed”. However, the retailer stated it does not believe that payment-card information or account passwords were impacted. The company’s website and app continue to operate normally, and ASOS maintains it holds a cyber insurance policy with a large global provider, though it noted it was “too early” to quantify any potential financial impact.
The Snowflake Connection: Claims vs. Reality
A critical element of the attackers’ claim revolves around Snowflake, a cloud-based data platform used by thousands of companies to store, process, and analyze data. The threat actors alleged they had “fully compromised” ASOS’s Snowflake instance.
However, Snowflake itself has pushed back against this claim. The cloud data giant told the BBC that while its investigation is ongoing, it has so far found “no compromise” of its platform. This discrepancy raises questions about the exact nature of the attack.
Cybersecurity experts note that sending a push notification requires access to ASOS’s notification system, which is separate from the Snowflake data platform. As Dan Bird from cybersecurity firm Horizon3 told the BBC, if both claims hold up, it suggests the attackers obtained credentials that “opened more than one door”. Alternatively, the attackers may be overstating their access to apply pressure on ASOS.
The “Brazen” Nature of the Attack
What makes this incident particularly notable is the attackers’ decision to go public directly to customers. Traditional ransomware and extortion attacks are conducted in private, allowing for negotiations and discretion. This attack, however, “turned ASOS’s own app into their ransom note,” as Charlotte Wilson from Check Point described it.
Security experts have labeled the move “brazen” and “deeply serious,” noting it may go down as a significant moment in cyber-attack history. By broadcasting the breach directly to millions of users, the attackers aim to maximize reputational damage and pressure ASOS into paying a ransom.
The BBC’s Verify service analyzed the Telegram channel linked in the notification and found that the usernames and language used “appear to have been translated from Chinese,” suggesting the group may have ties to Chinese-speaking threat actors. However, this does not conclusively establish their origin.
Financial Fallout and Broader Implications
The market reaction was immediate and severe. ASOS shares tumbled by nearly 10% on the London Stock Exchange following the incident, wiping an estimated $133 million from the company’s value. This drop is particularly painful for a company that had been showing signs of a successful turnaround, with shares having more than doubled earlier in the year.
The incident highlights a troubling trend for UK retailers. In recent years, major brands including Marks & Spencer, the Co-op, and Harrods have all suffered significant cyberattacks. A recent report ranked retail and manufacturing as the UK’s most security-exposed industries, with 77% of UK data breaches in 2025 attributed to human error or process failure rather than sophisticated hacking.
For ASOS customers, the immediate risk extends beyond the initial breach. The National Cyber Security Centre (NCSC) has warned individuals not to click on any suspicious links and to stay vigilant against phishing messages seeking to exploit the incident. The exposure of names and contact details, while less sensitive than payment data, still provides attackers with valuable information for convincing impersonation attempts.
FAQ: What ASOS Customers Need to Know
Q: Have my payment details been stolen?
According to ASOS’s official statement, the company does not believe that payment-card information was impacted. However, you should monitor your bank statements and online transactions for any unusual activity as a precaution.
Q: Was my password compromised?
ASOS has stated that it does not believe account passwords were affected. Nevertheless, security experts recommend changing your ASOS password as a precautionary measure, especially if you use the same password on other websites.
Q: What should I do if I received the notification?
ASOS has advised customers not to click or engage with the link contained in the notification. The NCSC also warns against clicking on suspicious links and recommends following their online safety guidance.
Q: How many customers were affected?
The exact number remains unclear. ASOS has not disclosed how many customers received the notification or how many may have had their information accessed. The ASOS app has been downloaded over 10 million times on Android devices alone, and the company serves approximately 17 million customers across more than 150 markets.
Q: Is it safe to use the ASOS app and website?
ASOS has confirmed that its website and app are operating as normal, with no current disruption to operations. The company has promised customers they can “shop with confidence” while the investigation continues.
Q: What is Snowflake, and why does it matter?
Snowflake is a cloud-based data storage and analytics platform used by more than 12,000 companies worldwide. The attackers claimed to have compromised ASOS’s data stored on Snowflake, though the company itself has found no evidence of a platform breach. ASOS uses third-party tools that run on Snowflake for marketing and customer analytics, which could theoretically expose detailed customer profiles if compromised.
Q: What should I watch out for after this breach?
Be cautious of emails, texts, or calls claiming to be from ASOS or offering “help” with the breach. These are likely phishing attempts designed to steal further information. Do not share personal or financial details with unknown senders. Monitor your accounts for unusual activity and consider enabling two-step verification on your email and banking accounts.
Q: Will ASOS face regulatory consequences?
Under UK GDPR, companies are generally required to notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of a qualifying personal-data breach. ASOS had not yet informed the ICO as of the initial reports. The company’s handling of the incident and its communication with affected customers will be closely scrutinized by both regulators and the public.
