ASOS has confirmed that customer information was accessed after an unauthorised notification appeared in its app, turning the retailer’s own communication channel into a warning aimed at its data-protection and IT teams. The company says names and contact details may have been accessed, but it does not believe payment-card information or account passwords were affected. The scale of the incident and the attackers’ route into the systems remain under investigation. [1] [2]
Key points
- A rogue “ASOS HACKED” notification was sent to customers at about 10am on 6 October, according to ASOS’s regulatory disclosure and independent reporting. [1] [2]
- ASOS says unauthorised activity involved third-party platforms used to communicate with customers and that it restricted access to the notification systems. [1]
- The company’s current position is that names and contact details may have been accessed, while payment-card details and account passwords were not believed to be affected. [1] [3]
- A message claiming that a Snowflake instance had been compromised has not been independently established; Snowflake said its own platform had not been compromised so far. [2] [4]
- A later BBC report, retrieved after this story’s research cutoff, said ASOS had told customers that more detailed profiles may be involved; the scale still was not stated. [6]
What happened
The incident became visible when ASOS app users received a push notification headed “ASOS HACKED”. The message was addressed to the retailer’s data-protection officer and IT teams, told them that a Snowflake instance had been “fully compromised” and directed recipients to a Telegram channel. ASOS confirmed in a filing to the London Stock Exchange that an unauthorised customer notification had been sent at around 10am on 6 October. [1] [2]
ASOS said the activity involved third-party platforms used to communicate with customers. It said it took immediate action to restrict access to the notification platforms and was working with internal and external specialists and relevant authorities. The company also said its website and app were operating normally, with no current disruption to its operations. [1] [4]
This distinction matters. The appearance of a malicious or unauthorised message in an app does not, by itself, show that a customer’s phone was hacked. It indicates that someone gained enough access to a customer-communications route to send a message to users. The separate question of what customer data was reached is still being resolved.
What data may be involved
In its primary disclosure, ASOS said basic personal information, including names and contact details, may have been accessed. It said it did not believe payment-card information or account passwords were impacted. The Guardian reported the same company position, while SecurityWeek noted that ASOS had not identified the compromised third-party platform or confirmed that Snowflake itself had been breached. [1] [3] [4]
TechCrunch reported on 8 October that ASOS had confirmed names and contact information were taken. It also said the company had not explained how attackers reached the push-notification system or whether multi-factor authentication protected the relevant environment. Those are important technical gaps because a data platform and a notification service can be separate systems, even when an attacker claims access to both. [5]
A BBC follow-up retrieved after the 10:47:05+05:30 research cutoff reported a broader customer update. It said names, addresses, phone numbers, email addresses, customer numbers, dates of birth and website search histories were among the information allegedly in criminals’ possession. The BBC said ASOS still maintained that bank details and passwords were not accessed. Because this report arrived after the cutoff and relied partly on a sample supplied by alleged criminals, those additional categories should be treated as a later reported development pending fresh first-party confirmation, not silently presented as the position known at the cutoff. [6]
Why it matters
The incident creates two risks for customers. The first is the underlying exposure of personal information. The second is follow-on fraud. A name, address, phone number or shopping-history detail can help a scammer make a message appear genuine. The Guardian and BBC both reported warnings that criminals could use the publicity around the incident to send convincing emails, texts or calls about orders, refunds, password resets or account security. [2] [3]
The event also shows why third-party communication systems deserve the same scrutiny as customer-facing applications. A company can keep its storefront operating while an external notification route is misused. That means “the app is working” and “no card data was accessed” do not answer every question about identity, privacy or future phishing risk.
For customers, the safest response is to avoid links in the rogue notification and visit ASOS through its normal website or app entry point. Customers should be cautious about unsolicited requests for passwords, security codes or payment information. They can also monitor accounts and transactions for unusual activity and use unique passwords across services. These precautions do not prove that a particular account was compromised; they reduce the chance that a later scam succeeds.
What remains uncertain
ASOS has not disclosed how many customers received the message or how many records were accessed. No verified figure should be inferred from the app’s download count or the retailer’s overall customer base. The company also has not publicly identified the third-party platform, explained the initial access path in its exchange filing or confirmed who operated the Telegram channel.
The Snowflake claim remains especially important to separate from established facts. The message claimed a Snowflake instance had been compromised, but BBC reported that Snowflake’s investigation had found no compromise of its own platform so far. SecurityWeek likewise said ASOS had not confirmed that its Snowflake instance was hacked. TechCrunch reported that the attackers may have used a platform built on Snowflake, but that account did not resolve the issue. [2] [4] [5]
The name used by the alleged attackers is not proof of identity or nationality. Nor does the notification prove that every ASOS customer was affected. Those determinations require the company’s forensic investigation and, where relevant, notifications to affected people and authorities.
What happens next
ASOS said it was working with specialists and relevant authorities, and the BBC reported that the UK’s National Cyber Security Centre had offered assistance. The company has said it will provide an update if the situation changes. [1] [2]
The next useful milestones are a clearer account of the affected platform, a confirmed list of data categories, an explanation of how access was obtained and direct customer notices where additional action is required. A customer-count estimate would also help people understand the scope, but it should come from ASOS or an official investigation rather than attacker claims.
Until those details arrive, the most accurate description is a confirmed unauthorised notification and customer-data breach involving an ASOS communications route, with the full scope still unsettled. Readers should follow direct ASOS communications, avoid external links sent in connection with the incident and treat unexpected requests for sensitive information as potential impersonation attempts.
