ASOS 'Snowflake Hack': App Users Report 'Scary' Notification

Some ASOS users have reported a notification from the retailer's app that mentions a "Snowflake instance".

In an X post, site user Dan wrote: "Anyone else just get a notification from iOS ASOS UK with a message 'ASOS HACKED: We've taken over the Snowflake instance…'."

Commenters have shared that they experienced the same thing.

The notification reads: "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it," followed by a link, which reportedly l eads to a Telegram chat.

DPO refers to the company's data protection officer, who is in charge of keeping customer information safe. Meanwhile, Snowflake is a data platform many companies use, including OpenAI .

And "instance" is a tech term for a specific piece of software.

Pieter Arntz, senior malware intelligence researcher at Malwarebytes , said: "ASOS uses Simon AI for marketing, which runs on Snowflake, making the connection indirect.

"Any exposure could reveal a detailed customer picture, from browsing and buying habits to location and loyalty status. That's valuable profiling data, though the connection alone doesn't establish what attackers could actually access."

Some notification headers read, ASOS HACKED, according to on X.

Posts began rolling in around 10am on Tuesday, 6 October.

But Downdetector, which tracks reports of outages and site issues, showed that problems may have begun just before then.

Per Arntz, "It's too early to say how much ASOS customer data attackers could get their hands on, but the potential scope is significant".

Under Dan's initial post, commenters wrote that they were "scared" by the notification and wrote that it looks "pretty bad".

Around half past three on the afternoon of October 6, the company provided an update .

It reads, "ASOS can confirm that, at around 10am today, an unauthorised customer notification was sent to ASOS customers.

"We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers".

ASOS said they don't think card information or account passwords were compromised, though "basic personal information including name and details may have been accessed".

We've shared their update and Instagram story on the topic in full in a separate article.

Kamran Bahdur, CIO at data management and cybersecurity company FLR Spectron , said: "This should be taken seriously and treated as a potential extortion attempt until we've verified the facts.

"The immediate priority is to establish whether there has been any unauthorised access, review Snowflake audit and authentication logs, assess any data exposure, and follow the incident response process.

"Any decision on engaging with the threat actor should be made with input from legal, regulatory and law enforcement partners. It's also important that personnel avoid direct engagement with the threat actor outside of an agreed response strategy."

Other experts have advised against clicking either the notification or the link it contains.

Junade Ali, cybersecurity expert and fellow at The Institution of Engineering and Technology, told The Independent : "Users should take steps to ensure they are using randomly-generated, long, unique passwords for different accounts, enable Two-Factor Authentication where possible, and back up important data.

"Be wary of scammers who may attempt to use any personal data for scams."

Under UK law, companies have to report data breaches within three days.

As of the time of writing, ASOS has not updated either its site or its social media channels a possible hack.

The retailer's price has plummeted by 12.5% since reports of the supposed hack broke.

This is a breaking news story and will be updated. Follow HuffPost UK on Twitter , and Instagram .