Back Securityweek

ASOS Confirms Cyberattack, Data Breach

Securityweek •Ionut Arghire • October 7, 2026

British online retailer ASOS has confirmed that hackers compromised a third-party communication platform after users received rogue notifications on their phones.

Over the past couple of days, numerous ASOS users in the UK complained receiving a pop-up notification on their mobile apps, titled “ASOS hacked”.

“Dear ASOS DPO [data protection officer] and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it,” the notification read.

In a Tuesday filing with the London Stock Exchange, the clothing and cosmetics retailer confirmed that its users received unauthorized notifications after a third-party platform used for customer communication was hacked.

“We took immediate action to restrict access to the notification platforms and are working with our internal and external specialist advisers, as well as all relevant authorities,” ASOS said.

According to the company, the hackers might have accessed basic user information, including names and details.

“We do not believe that payment-card information or account passwords were impacted,” the company said.

ASOS pointed out that its website and application have not been affected, and that its operations have not been disrupted.

The company has not shared details on which platform was compromised and who was behind it, and made no mention of its Snowflake instance being hacked.

“Snowflake is a data analysis and AI platform used by several organizations. In 2024, ShinyHunters hacked Snowflake instances of over 160 organizations and stole sensitive data that was used for extortion. They used credentials obtained from infostealers for initial access. This recent hack may be similar, although it is not confirmed what the initial access was,” said Forescout Research – Vedere Labs VP of research Daniel dos Santos.

The incident was claimed by a hacking group calling itself Xuanye Group, on a newly created Telegram channel. The name points to a Chinese-speaking threat actor, but could also be a false flag, dos Santos said.

“If the attackers have successfully compromised ASOS via a Snowflake vulnerability, hopefully this will be investigated as a priority to understand whether this could impact further organizations utilizing the online data platform,” Talion Cyber Security head of threat intelligence Natalie Page said.

“Directly messaging customers via the ASOS app is an interesting move which highlights that the attackers want to gain publicity around the breach. This is a typical tactic of extortion groups, who often leverage media attention and publicity to apply further pressure to victim organizations,” Page added.

Related: 8.8 Million Impacted by Data Breach at Denmark’s Central Person Register

Related: 250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms

Related: Pentagon Personnel Agency Data Breach Impacts 3 Million People

Related: DC Health Agency Exposes 400,000 Beneficiary Records

Ionut Arghire is an international correspondent for SecurityWeek.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ASOS App Notification Hack: Data Breach Threatens Customer Information On October 6, 2026, ASOS customers received alarming push notifications from the retailer's app, claiming that the company's Snowflake data platform had been fully compromised. The message, addressed to ASOS's data protection officer and IT team, threatened to leak sensitive data unless the company engaged with the attackers. The notification included a link to a Telegram channel operated by a group calling itself the Xuanye Group. ASOS has not confirmed any breach but is investigating unauthorized activity involving third-party platforms. Initial reports indicate that basic personal information may have been accessed, but payment card information and passwords are believed to be safe. The incident has caused ASOS shares to drop by approximately 10%. Experts warn that the method of delivery indicates a serious breach of ASOS’s systems, raising concerns about customer data exposure. 85 sources 54

Extracted Entities

ASOS Confirms Cyberattack, Data Breach

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (2)

Countries (2)

CWE Weaknesses (1)

Industries (1)