By On the morning of 6 October 2026, shoppers who had the ASOS app installed received a push notification that looked unlike any sale alert. Titled ” ASOS HACKED”, it was addressed to the retailer’s own data protection officer and IT team, claimed its Snowflake instance had been “fully compromised” and included a link to a Telegram channel.
The message alarmed customers and quickly wiped more than 10% from ASOS’s share price. Two days later, ASOS said the incident was not a vulnerability in its website, but a social engineering attack in which an employee account was compromised, and Snowflake issued its own denial that its platform was responsible. This analysis sets out what has been confirmed, what remains unverified, and what it means for ASOS data breach concerns.
Timeline: how the ASOS cybersecurity incident unfolded
- Around 10:00 BST, 6 October 2026: ASOS customers report receiving an unauthorised push notification via the ASOS app. Screenshots show the text: “Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.” The notification links to a newly created Telegram channel named “Xuanye Wen Gateway” or “Xuanye Group”, a name not linked to any previously known hacking group.
- 6 October afternoon: ASOS confirms to The Register and other outlets that an unauthorised customer notification was sent and says it is investigating. It states that basic personal information including name and contact details may have been accessed, but that it does not believe payment-card information or account passwords were impacted. Its website and app remain operational.
- 7 October: Snowflake tells media it has “found no compromise of the Snowflake platform” at that time. The alleged attackers contact BBC News and share a sample of data to support their claim.
- 8 October: ASOS releases a more detailed statement, saying an “unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain log in credentials” and that “those credentials were then used to access information on certain third-party platforms used by ASOS”. It says affected platforms were immediately locked down and that it is working with internal and external cyber specialists and relevant law enforcement and regulatory authorities.
- 9 October: Snowflake updates its statement to say: “We can confirm this issue did not in any way result from a vulnerability, weakness, flaw, or misconfiguration with the Snowflake service, platform, or internal environments, and was not caused by Snowflake. No remediation is required for Snowflake customers.”
How was access reportedly obtained?
According to ASOS, the root cause was not a flaw in its own website code, but credential theft through impersonation. In plain terms, this is a form of social engineering and phishing.
An attacker pretends to be someone the employee trusts – for example a colleague, supplier or IT helpdesk – and convinces them to hand over login details, perhaps via a fake login page or a message asking them to share a code. If the employee’s account has access to marketing tools that can send push notifications or to data stored in third-party systems, those credentials can then be abused.
This distinction matters. Many breaches involve exploiting software vulnerabilities. Social engineering instead exploits human trust. As the UK National Cyber Security Centre’s phishing guidance explains, layered defences and strong reporting processes are needed because a single convincing message can bypass a password if additional protections are not in place.
ASOS has not disclosed which employee role was affected, how the impersonation occurred, or whether multifactor authentication was in use. Those details are likely part of the ongoing investigation.
Why is Snowflake responding and what does it deny?
Snowflake is a cloud data platform used by thousands of organisations to store and analyse large datasets. Many retailers use it to hold customer and order analytics separate from their live shopping site. Its name appeared in the ransom-style notification, which claimed ASOS’s “Snowflake instance” was compromised.
There is an important technical difference between two scenarios:
- Compromise of a customer’s account that uses Snowflake: An attacker steals credentials for a Snowflake customer account and accesses data that customer stored there. The underlying Snowflake service itself is not broken into.
- Compromise of Snowflake’s own platform: An attacker finds a vulnerability or misconfiguration in Snowflake’s service that lets them break into multiple customers without needing their credentials.
Snowflake is firmly denying the second scenario. Its 9 October statement says the issue “did not in any way result from a vulnerability, weakness, flaw, or misconfiguration with the Snowflake service, platform, or internal environments, and was not caused by Snowflake”. Its earlier statement said it had found no compromise of the Snowflake platform.
That denial does not by itself confirm or deny whether an ASOS-related Snowflake customer account was accessed using stolen employee credentials. Snowflake’s comments address its own platform, not necessarily what an attacker could do with legitimate credentials for a connected third-party platform. ASOS says the credentials were used to access information on “certain third-party platforms” and that those platforms were locked down, but it has not publicly named all platforms involved.
This context is also sensitive because in 2024, customers of Snowflake were targeted in a large-scale campaign where attackers used stolen credentials to access accounts at Ticketmaster, Santander, AT&T and others, leading to criminal charges in that case. The ASOS incident is separate and currently attributed by ASOS to impersonation of a trusted contact.
What customer data may be affected in the ASOS hack?
ASOS has said “basic personal information including name and contact details may have been accessed” and that customers’ “certain non-personal account-related information” may also have been accessed, according to reporting of its customer email.
It has consistently said it does not believe payment-card information or account passwords were impacted. That would mean card numbers, expiry dates, CVVs and passwords are not believed to be part of the accessed data, but ASOS has used cautious language – “may have been accessed” and “we do not believe” – which indicates the investigation is still determining full scope.
Even basic contact details carry risk. Names, email addresses and phone numbers can be used for targeted phishing, where a criminal sends messages that appear to come from ASOS offering refunds, order updates or breach support, and tricks recipients into clicking links or sharing codes. That is why ASOS warned customers to remain cautious of unexpected messages or calls claiming to be from ASOS.
The number of customers affected has not been officially confirmed. ASOS has 16.5 million customers and operates in more than 150 markets, but it is not yet clear how many records were accessed versus how many people received the rogue push notification, which was sent via a third-party communications platform rather than from Snowflake directly.
What should ASOS customers do now?
If you received the notification or shop with ASOS, the NCSC’s top tips for staying secure online and ASOS’s own advice point to the same proportionate steps:
- Do not click the link in the suspicious notification. Delete the ” ASOS HACKED” notification if it is still visible. Do not forward the Telegram link.
- Go to ASOS directly. Open the official ASOS app from your app store or type asos.com into your browser rather than following links in emails, texts or messages claiming to be about the breach.
- Be wary of follow-up scams. Treat any unexpected email, text or call offering a refund, asking you to reset your password, or offering breach compensation as suspicious. ASOS says it will not ask for passwords or payment details via unsolicited messages.
- Never share verification codes or passwords. A legitimate retailer will never ask you to confirm your full password, one-time code or card number by email or phone.
- Check for password reuse. If you used the same password for ASOS as elsewhere, change it on those other sites and consider using a password manager and three random words as recommended by the NCSC. Enable two-step verification where available.
- Monitor your accounts. Watch for unusual emails or login attempts. If you see suspicious activity, contact ASOS through the help section of its official app or website, not through contact details provided in a suspicious message.
ASOS has said its website and app remain safe to use and that it has cyber security insurance. If you are concerned you have been targeted by phishing as a result, you can report it to Action Fraud and forward suspicious emails to the NCSC’s suspicious email reporting service.
What does this incident reveal about business cybersecurity?
For retailers, the incident underscores why securing employee accounts that can reach customer-facing systems is as important as securing the customer database itself. A single account with permission to send push notifications can, if compromised, cause reputational damage far beyond the data accessed, because it uses the company’s own trusted channel to reach customers.
Key lessons highlighted by security experts include:
- Phishing-resistant multifactor authentication: Using FIDO-based passkeys or hardware keys rather than SMS codes makes credential theft much harder. The NCSC now encourages organisations to offer customers passkeys by default and to apply similar standards internally.
- Least-privilege access: Ensuring employee accounts only have access to the third-party platforms they absolutely need, and that marketing notification tools are isolated from sensitive analytics data.
- Third-party integration monitoring: Watching for unusual activity on connected platforms such as data warehouses, email and push-notification providers, not just the main website.
- Incident response and customer communication: Having a plan to quickly revoke access, lock down platforms, and issue clear, verified communications through official channels when a trusted channel is abused.
The attack also shows why attackers may choose to announce themselves via a notification rather than staying silent. Sending a public “we have your data” message pressures a company to engage and creates confusion that can be leveraged for further phishing.
What remains unknown about the Snowflake ASOS breach?
Several questions are still open and should not be filled with speculation:
- Full scope of data accessed: ASOS says basic personal information may have been accessed, but has not published a complete list of fields or number of affected individuals.
- Precise technical path: How exactly the impersonation occurred, which third-party platforms were accessed beyond the notification system, and whether any Snowflake customer account was accessed using stolen credentials remain under investigation.
- Identity and motive: Those claiming responsibility call themselves the Xuanye Group, a name not recognised as an established group. Security researchers noted the linked Telegram channel was newly created on 6 October, with the underlying account previously associated with gaming-item trading, suggesting a fabricated or repurposed persona. This has not been independently verified by authorities.
- Regulatory notification: ASOS says it is working with relevant law enforcement and regulatory authorities. Any formal findings from the UK Information Commissioner’s Office or other regulators have not yet been published.
Until the investigation concludes, it would be inaccurate to state that Snowflake itself was hacked, or that payment data was stolen. The confirmed facts are: an unauthorised notification was sent, ASOS attributes this to credential theft via impersonation, basic contact data may have been accessed, and Snowflake denies a vulnerability or misconfiguration in its platform caused the incident.
FAQs
Was the ASOS data breach caused by Snowflake?
Based on statements to date, no. Snowflake says its investigation found no compromise of its platform and that the incident did not result from a vulnerability, weakness, flaw or misconfiguration in its service. ASOS says credentials for an employee account were obtained via impersonation and then used to access information on certain third-party platforms. The precise platforms have not been fully detailed publicly, but Snowflake maintains its platform was not breached.
What did the ‘ASOS HACKED’ notification say?
Customers reported a push notification around 10am BST on 6 October 2026 titled “ASOS HACKED” addressed to “Dear ASOS DPO and IT” claiming the Snowflake instance had been fully compromised and demanding engagement or data would be leaked. It included a link to a Telegram channel. ASOS confirmed it was unauthorised and not sent by its team.
Is my payment information safe after the ASOS cybersecurity incident?
ASOS has said it does not believe payment-card information or account passwords were impacted. It says basic personal information including names and contact details may have been accessed. As a precaution, avoid sharing card details in response to unsolicited messages, monitor your bank statements, and use official ASOS support channels if you are concerned.
What should I do if I clicked the Telegram link?
If you clicked the link but did not provide personal information or download anything, the immediate risk is low, but remain vigilant for phishing. If you entered credentials or payment details, change your passwords immediately, contact your bank, and report the phishing attempt. You can also run an antivirus scan and clear your browser cache.
How can I protect my data after the ASOS hacking message?
Follow NCSC guidance: use strong, unique passwords managed by a password manager, enable two-step verification or passkeys, be cautious of messages claiming to be from ASOS, and access ASOS by typing the address directly. Forward suspicious emails to report@phishing.gov.uk and report scam texts to 7726.
This article is based on ASOS and Snowflake statements issued between 6-9 October 2026, reporting by The Times, The Register and BBC News, and UK NCSC guidance. The investigation is ongoing and details may change as more information is verified.