ASOS app users get an 'ASOS HACKED' alert as attackers claim a Snowflake breach

The alert: the notification went to people who have the ASOS app installed. DPO refers to a company's data protection officer, the person responsible for keeping customer information safe, HuffPost UK explains.

When: posts about it began appearing around 10am UK time on Tuesday, October 6, according to HuffPost UK. Downdetector showed problems may have started just before then. LADbible reports about 500 reports about the website and app came in at 9:41am.

Where: reports came from users in several countries, including the UK, US, Germany and Australia, City AM says.

The attackers' claim: in a message on the Telegram channel, a user named "Xuanye Group" said customers' payment information had not been affected. "That is all for now," the apparent hackers wrote, according to City AM.

Very little.

ASOS is understood to be investigating whether any hack took place, City AM reports. It's not yet clear:

• how the attackers managed to send a notification through the ASOS app;
• whether ASOS's Snowflake systems were compromised as claimed;
• how many customers may have been affected.

ASOS's chatbot told users the company is "currently investigating" the notification, Sky News reported, according to HuffPost UK. A customer service representative added: "We don't have any further information to share at this stage, but we'll provide an update as soon as we know more." That isn't an official statement from the retailer.

As of HuffPost UK's report, ASOS hadn't posted an update on its website or social media. Several outlets said ASOS had been approached for comment.

The platform: Snowflake is a cloud data platform used by many companies, including OpenAI, HuffPost UK notes. City AM says ASOS uses it to process data like clothing sizes and body measurements, and that the platform also lets the user send notifications to clients' phones.

The marketing link: Pieter Arntz, senior malware intelligence researcher at Malwarebytes, said ASOS uses Simon AI for marketing, which runs on Snowflake, "making the connection indirect."

"Any exposure could reveal a detailed customer picture, from browsing and buying habits to location and loyalty status," Arntz said. "That's valuable profiling data, though the connection alone doesn't establish what attackers could actually access."

"It's too early to say how much ASOS customer data attackers could get their hands on, but the potential scope is significant," he added.

Security experts were struck by how the threat was delivered.

"The attackers aren't simply claiming to have breached ASOS – they're publicly telling the company to engage with them or they will leak what they say they have obtained," said Marijus Briedis, chief technology officer at NordVPN, according to City AM. He called the message "unusually brazen and threatening."

"What makes it even more concerning is how that threat appears to have been delivered," Briedis said. "A message apparently written for ASOS's data protection and IT teams has instead been pushed directly to customers through the company's own app notification system."

Kamran Bahdur, CIO at FLR Spectron, said the message "should be taken seriously and treated as a potential extortion attempt until we've verified the facts," HuffPost UK reports. He said the priority is to check for unauthorized access, review Snowflake audit and authentication logs, and assess any data exposure.

"Any decision on engaging with the threat actor should be made with input from legal, regulatory and law enforcement partners," Bahdur added. "It's also important that personnel avoid direct engagement with the threat actor outside of an agreed response strategy."

Many were rattled. "Anyone else just get a notification from iOS ASOS UK with a message 'ASOS HACKED: We've taken over the Snowflake instance…'" one user wrote on X. Commenters under that post said they were "scared" and that it looked "pretty bad," HuffPost UK reports.

Others took it in stride. "Whilst ASOS has been hacked can the hacker give us a discount code please and thank u," one person wrote, according to LADbible. Another said: "Hackers sending ransom notes via push notification is diabolical. Long day for ASOS."

ASOS: shares in the London-listed retailer fell by as much as 10% to 439p, City AM reports. HuffPost UK put the drop at 12.5% since reports of the apparent hack broke.

Snowflake: shares fell about 3% in premarket trading in the US, Seeking Alpha reports. Snowflake didn't immediately respond to its request for comment.

Bad timing: ASOS has about 17 million active customers in more than 150 countries and reported revenue of about £2.5 billion in 2025, according to City AM. Its shares were up more than 50% this year before Tuesday, and last month it raised its pre-tax earnings target to £150 million to £180 million.

A turnaround interrupted: ASOS has been trying to revive its fortunes after several difficult years for online fashion. Chief executive José Antonio Ramos Calamonte had been making progress, City AM notes, and the company had cited "materially improved profitability" when it raised its earnings target.

In tech terms, an "instance" is a specific running copy of a piece of software, HuffPost UK explains. So the attackers are claiming access to ASOS's own Snowflake environment, not to Snowflake as a whole.

That distinction matters. Malwarebytes' Arntz described ASOS's connection to Snowflake as indirect, through its marketing software, and so far the only claim of a breach comes from the attackers themselves.

If ASOS confirms personal data was compromised, it may have to report it. Under UK data protection rules, organizations generally have 72 hours to notify the Information Commissioner's Office after becoming aware of a personal data breach that poses a risk to people's rights and freedoms, City AM notes. Affected people must also be told without undue delay if a breach is likely to pose a high risk.

British retailers have been hit by several cyberattacks in recent years, with Marks & Spencer, Co-op and Harrods among them, City AM notes.

• If you got the alert: don't tap the notification or the link in it. Experts advised against clicking either, HuffPost UK reports.
• If you shop at ASOS: change your password to a long, unique one, turn on two-factor authentication where possible and back up important data, cybersecurity expert Junade Ali told The Independent.
• Watch for scams: "Be wary of scammers who may attempt to use any personal data for scams," Ali said. Treat unexpected emails or texts about your ASOS account with suspicion.