ASOS customers woke up to an unusual push notification on the morning of October 6, 2026. Instead of a flash sale or a restock alert, the message read “ASOS HACKED” and pointed to a Telegram channel. Inside that channel sat a direct threat aimed at the retailer’s data protection and IT teams: comply, or watch your customer data get leaked. Nine hours later, ASOS confirmed the notification was real, that attackers had hijacked a third-party communication platform, and that it was now racing to contain a breach whose full scope remains unclear.
What makes this incident worth a second look, a day after the initial alert, isn’t the notification itself. It’s what happens next: how a retailer handles the 72-hour window UK regulators expect for breach notification, whether a vendor-side compromise counts as “ASOS’s problem” under GDPR, and where this fits inside a UK retail sector that has now absorbed a string of extortion campaigns routed through supply-chain platforms rather than the retailers’ own networks. Our newsroom covered the alert as it broke and tracked the market reaction that followed. This piece picks up where those left off: the investigation, the legal exposure, and what the pattern says about where retail security is actually failing.
What ASOS has confirmed so far
ASOS has been careful with its language, and that caution is itself informative. The retailer said it is investigating “unauthorised activity involving third-party platforms that we use to communicate with customers,” a phrasing that keeps the breach one step removed from ASOS’s own core systems. It separately confirmed that an “unauthorised customer notification” went out, which is the company’s way of acknowledging the push alert without endorsing anything the attackers claimed inside it.
On the data side, ASOS said basic personal information, including customer names and contact details, may have been accessed. It also said it does not believe payment-card information or account passwords were affected. That line matters more than it might look: card data and passwords are the two categories that trigger the most expensive consumer-protection obligations, like card reissuance and credential-reset campaigns, so if it holds up under investigation, the direct remediation cost to ASOS is a fraction of what a payment-data breach would cost.
ASOS also said it has restricted access to the notification platforms involved and is working with internal and external specialist advisers, alongside relevant authorities, which in the UK context means the Information Commissioner’s Office and likely the National Crime Agency. None of that confirms that the Snowflake instance referenced in the attacker message was actually compromised. As of this writing, that specific claim remains unverified, and ASOS has not addressed it directly in public statements.
The message, and why it points at Snowflake
The text pushed to ASOS app users was blunt. It read, “Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it,” according to reporting from the Evening Standard and corroborated by the BBC, which quoted the closing line, “Engage with us, or we will leak it,” in its own coverage of the alert.
Snowflake is a cloud data warehouse used across retail, finance, and media to centralize customer records, sales data, and analytics. It is not a vulnerability in the traditional sense of a buggy piece of software. Most Snowflake-linked breaches over the past two years have worked through stolen or reused customer credentials, not a flaw in Snowflake’s own platform. That distinction is probably why a Snowflake spokesperson pushed back directly on the attacker’s framing, telling Business Insider: “At this time, we can report that we have found no compromise of the Snowflake platform.” Read together, ASOS’s own caveated language and Snowflake’s denial suggest the entry point, if there was one, sits somewhere in how ASOS or a vendor accessed Snowflake, not inside Snowflake’s infrastructure itself.
A group identifying itself through the Telegram channel also claimed, in a statement reported by AOL UK, that “Regarding ASOS, payment information is not affected.” That lines up with what ASOS itself has said, which is unusual, since attacker claims and victim statements rarely agree on anything. Treat this convergence as a data point, not proof. Self-reported claims from either side of an extortion attempt carry obvious incentives to shape the narrative.
Timeline of the ASOS breach notification
| Time (Oct 6, 2026, UK) | Event |
|---|---|
| Approx. 10:00 a.m. | ASOS app users receive push notification titled “ASOS HACKED” or “Asos hacked” |
| Morning | Notification links to a Telegram channel containing an extortion message referencing a Snowflake instance |
| Mid-morning | Screenshots circulate on social media, Downdetector reports spike as users question whether the app itself was compromised |
| Afternoon | ASOS confirms an “unauthorised customer notification” was sent and opens an internal investigation |
| Afternoon | Snowflake issues a denial that its own platform was compromised |
| Evening | ASOS states basic personal data may have been accessed, but payment cards and passwords are believed unaffected |
| October 7 | Coverage expands across BBC, The Guardian, Infosecurity Magazine, and trade press, attacker identity remains unconfirmed |
Who is behind it, and why that’s still an open question
Some early reports attributed the notification to a group calling itself “Xuanye Group.” That attribution has not been independently confirmed, and readers should treat it as a claim circulating in the Telegram channel rather than an established fact. Attribution in extortion campaigns like this one is routinely murky in the first 24 to 48 hours. Multiple groups sometimes claim the same breach to ride the publicity, and genuine attackers sometimes borrow another group’s branding to muddy forensic attribution. Given that pattern, the group name is best treated as unverified for now, alongside the core claim of a “fully compromised” Snowflake instance.
What is not in question is the delivery method. Pushing a hostile message through a brand’s own official app notification channel is a tactic built for maximum visibility and reputational pressure, not maximum data exfiltration. It guarantees press coverage and customer panic within minutes, which is exactly the leverage an extortion group wants when the actual data-theft claim can’t yet be verified by anyone outside the negotiation.
How this fits the UK retail breach pattern
ASOS is not an isolated case. UK retailers have spent much of the past 18 months absorbing a wave of extortion-driven breaches that route through third-party platforms, vendor credentials, or customer-communication tools rather than a retailer’s primary e-commerce stack. The common thread across these incidents is that the attacker rarely needs to break anything. They need a reused password, an exposed API key, or a compromised vendor account, and the rest follows from there.
This pattern isn’t limited to fashion retail or to the UK. Our coverage of the Denmark CPR breach affecting 8.8 million people showed the same dynamic playing out against a national identity register. The ShinyHunters extortion campaign, which has targeted Snowflake-linked customer data across multiple sectors, follows an almost identical playbook: claim a large data haul, set a short negotiation window, and apply public pressure, whether through leak sites, social media, or in ASOS’s case, the brand’s own app, to force a response. Even outside the Snowflake-specific cases, consumer brands like Dodo Pizza, which disputed hacker claims of 68 million affected users after confirming a cyberattack, show how wide the gap can be between an attacker’s headline number and what a company is willing to confirm.
Why extortion-by-notification is becoming a repeatable tactic
Ransomware economics have shifted the incentive structure industry-wide. Our analysis of the broader trend, covered in ransomware data theft surging 275% as payments sink, found that attackers are increasingly skipping encryption altogether and going straight to data theft plus extortion, because victims have gotten better at restoring from backups but are still bad at knowing what data actually left the building. A hijacked push-notification channel is a logical next step in that evolution. It’s cheap to execute, doesn’t require deep network access, and manufactures public pressure faster than a quiet ransom note ever could.
Regulatory exposure: what GDPR actually requires here
Under UK GDPR, a data controller that becomes aware of a personal data breach generally has 72 hours to notify the ICO if the breach is likely to result in a risk to individuals’ rights and freedoms. The clock starts from when the organization becomes aware of the breach, not from when the full scope is confirmed, which puts ASOS on a tight timeline given the public nature of the October 6 notification. The ICO’s own guidance on reporting a personal data breach is explicit that controllers remain responsible for breaches that originate with a processor or third-party platform they use, which is directly relevant to ASOS’s framing of this incident as involving third-party communication tools.
That “it was a third party” framing is a familiar one in breach disclosures, and it rarely changes the controller’s legal exposure. If ASOS used a vendor platform to send customer notifications, and that platform, or credentials used to access it, was compromised, ASOS is still the data controller for the customer names and contact details involved. The National Cyber Security Centre’s incident management guidance similarly stresses that organizations need to validate third-party and supply-chain access controls as part of standard incident response, precisely because vendor compromise is now one of the most common entry points into retail customer data.
Market and reputational impact
ASOS shares already moved on the initial breach claim, a reaction we tracked in detail in our earlier report on the stock slide. Retail breaches tend to produce a short, sharp share-price dip followed by a slower recovery, unless the confirmed scope turns out to be worse than the market initially priced in. The bigger risk for ASOS isn’t the one-day stock move. It’s the erosion of trust in a retailer that depends heavily on app engagement and push notifications as a direct marketing channel. If customers start treating ASOS app alerts with suspicion after this incident, that undermines a core piece of the company’s retention strategy well beyond the immediate breach cycle.
Comparing ASOS to recent retail and consumer breaches
| Incident | Vector claimed | Data types | Confirmation status |
|---|---|---|---|
| ASOS (Oct 2026) | Third-party customer-notification platform, attacker claims Snowflake compromise | Names, contact details (basic personal info) | Partial: notification confirmed, Snowflake claim unconfirmed, payment data and passwords believed unaffected |
| Denmark CPR registry breach | National identity data system | Personal identification records for 8.8 million people | Confirmed at national level |
| Dodo Pizza cyberattack | Customer-facing systems | Disputed, hackers claimed 68 million users affected | Cyberattack confirmed, user-count claim disputed by company |
| ShinyHunters Snowflake-linked campaigns | Stolen or reused vendor/customer credentials into cloud data platforms | Varies by target, customer names, contact and account data | Varies by victim, several partially confirmed, others denied |
The pattern across this table is consistent: the attacker’s initial claim is almost always broader than what the targeted company ultimately confirms, and the actual compromised platform is frequently disputed between the victim and the platform vendor. ASOS fits squarely inside that pattern rather than standing apart from it.
Historical context: push notifications as an attack surface
Using a company’s own communication channel against its customers is not new, but it has typically shown up as compromised email-marketing accounts or hijacked SMS gateways rather than native app push notifications. App push infrastructure is attractive to attackers precisely because it sits outside most users’ mental model of “things that can be hacked.” An email can be flagged as phishing, but a push notification from an app a customer already trusts and has installed carries an implicit credibility a cold email never will. That’s a meaningful shift in the extortion playbook, and one that other retailers running their own branded apps should study closely rather than file under “ASOS’s problem.”
What ASOS, and other retailers, should do now
- Rotate and audit credentials for every third-party platform with access to the customer-notification pipeline, not just the one named in the attacker’s message.
- Confirm or rule out the Snowflake compromise claim through independent forensic review rather than relying on either the attacker’s or the vendor’s self-reported statements.
- Notify the ICO within the 72-hour window if the breach assessment confirms a risk to customers’ rights, regardless of how the third-party framing is eventually resolved.
- Communicate directly with affected customers through a verified channel, since the attack already damaged the credibility of ASOS’s own push-notification system.
- Review vendor access scopes across all customer-facing SaaS tools. This incident underscores that the weakest link is rarely the retailer’s core infrastructure.
Predictions: where this goes from here
- Expect ASOS to issue a follow-up statement within one to two weeks narrowing down whether the Snowflake claim holds up, since regulatory pressure and customer questions will force a more specific answer than Tuesday’s language.
- The disputed user-count pattern seen with Dodo Pizza and other recent breaches will likely repeat here. Any “millions of records” figure circulated by the attackers should be treated skeptically until ASOS or an independent forensic firm confirms it.
- More UK retailers will disclose similar third-party or vendor-platform incidents before the end of 2026, following the same credential-based entry pattern seen across the ShinyHunters-linked campaigns.
- Regulatory scrutiny of vendor and processor relationships under GDPR will intensify industry-wide, with the ICO likely to reference incidents like this one when updating supply-chain breach guidance.
- Retailers that rely heavily on app push notifications for marketing will begin adding verification mechanisms, such as in-app banners confirming “official” alerts, to rebuild the trust this kind of attack is designed to break.
Frequently asked questions
Was ASOS actually hacked?
ASOS has confirmed that an unauthorized notification was sent to app users and that it is investigating unauthorized activity involving third-party platforms used to communicate with customers. It has not confirmed the attacker’s specific claim of a “fully compromised” Snowflake instance.
Was my ASOS payment information exposed?
ASOS said it does not believe payment-card information or account passwords were impacted. This hasn’t been independently verified beyond the company’s own statement, but it is consistent with claims made by the group behind the Telegram message.
What data might have been accessed?
ASOS said basic personal information, including customer names and contact details, may have been accessed. The full scope of the breach has not been confirmed as of this writing.
Was Snowflake’s platform actually compromised?
Snowflake has denied it, telling reporters it found no compromise of its own platform. The attacker’s claim of a “fully compromised” Snowflake instance remains unverified by any independent source.
Who is responsible for the attack?
The identity of the attackers has not been independently confirmed. Some reports referenced a group called “Xuanye Group,” but this attribution is unverified and should be treated as a claim, not an established fact.
Is ASOS required to tell customers directly?
Under UK GDPR, organizations must notify the ICO within 72 hours of becoming aware of a breach likely to risk individuals’ rights, and in some cases must notify affected individuals directly if the risk is high. ASOS has said it is working with internal and external advisers and relevant authorities on its response.
How does this compare to other recent retail breaches?
It follows a now-familiar pattern: an attacker claim that outpaces what the company confirms, a disputed or unconfirmed platform compromise, and a core data set limited to basic personal information rather than financial data. Similar disputes played out around the Dodo Pizza cyberattack and several ShinyHunters-linked Snowflake campaigns.
What should ASOS customers do right now?
Treat any unsolicited message claiming to be from ASOS with caution, avoid clicking links in the original “ASOS HACKED” notification or any follow-up messages referencing it, and watch for official communication through ASOS’s verified website or customer service channels rather than push alerts.
Related
- ASOS “Hacked” Alert Sparks 400+ Downdetector Reports [2026]
- ASOS Shares Slide 10% After Hacker Breach Claim [2026]
- ShinyHunters’ FBI Claim: 5,000 Names, 2-3TB Data [2026]
- Ransomware Data Theft Surges 275% as Payments Sink [2026]
- Denmark’s CPR Breach Exposes 8.8 Million People [2026]
