When ASOS Hackers Turned the Customer App Into a Ransom Note

“Dear ASOS DPO (Data Protection Officer) and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.”

This was the in-app notification message received by the many customers of the global online retailer, ASOS , on 6 October 2026, as attackers claimed to have “fully compromised” the company’s Snowflake instance.

The message was followed by a link to a Telegram chat of a previously unheard of cybercriminal gang called the Xuanye group, a report from The Guardian notes.

At the time of writing, both the company’s app and website are still operational, though its shares have plunged by 14%.

“An attacker using ASOS’s own app to deliver a ransom note to customers is a brazen escalation,” says Tom Exelby , Head of Cyber Security at Red Helix .

“Most extortion happens behind closed doors, giving business time to investigate before it speaks publicly.

“ASOS has lost that window: the attacker has set the timeline and made customers the audience.

“If confirmed, this echoes the 2024 Snowflake campaign, where attackers simply logged in with stolen credentials. Modern breaches exploit trusted access rather than breaking in.

“Customers shouldn’t tap the link in that notification, and should treat any message claiming to be from ASOS with caution in the coming weeks.”

An attacker using ASOS’s own app to deliver a ransom note to customers is a brazen escalation Tom Exelby, Head of Cyber Security at Red Helix

An attacker using ASOS’s own app to deliver a ransom note to customers is a brazen escalation

Tom also advises ASOS to “take back the narrative with clear, early communication to customers and the ICO (Information Commissioner’s Office)”.

The fashion giant has since confirmed the incident and commented in a statement that “basic personal information including name and details may have been accessed.

“We do not believe that payment-card information or account passwords, were impacted,” ASOS notes, according to the BBC .

ASOS cyberattack: why did attackers message customers?

Marie Wilcox , VP of Market Strategy at Binalyze , calls the notification sent by attackers “psychological warfare, designed to whip up panic”.

“Attackers know that any panic piles on the pressure on ASOS to think paying up rather than taking time to develop a rational response.

“The few hours are crucial. ASOS cannot let panicked pressure dictate its response.

“The priority must be investigation, and closing the gap that allowed this mass notification to go out.

“Activity like this will surely have huge noise around it that leaves a clear trail, so there should be plenty of evidence of what happened and how to fix it.”

Jonathan Lee , Director of Cyber Strategy at TrendAI notes that the attackers appear to be targeting customer trust as much as the technology itself.

“The aim appears to be to turn a security incident into a public trust issue and trust is imperative in the world of online retailing,” Jonathan notes.

“This may also indicate a wider compromise than the attackers claim.

“Sending a push notification would typically require access to systems beyond the cloud data platform.

“If both claims are accurate, the attackers may have accessed multiple parts of the environment.”

What should ASOS and customers do amid hacking concerns?

Raghu Nandakumara , VP of Industry Strategy at Illumio , rightly points out that: “For customers, the biggest question right now is: is my data safe?”

“ASOS must quickly confirm whether data has in fact been taken and, if so, who is affected and what exactly has been compromised,” Raghu says.

“If confirmed, this incident shows how difficult it has become for retailers to secure increasingly interconnected digital ecosystems.

“Modern retail is built on an ecosystem of cloud platforms, applications and third-party providers, and every trusted connection can potentially become a route an attacker tries to exploit.”

According to Tom, the first priority is to “shut the door”.

“Revoke and rotate every credential and API key linked to the notification platform and Snowflake, and enforce MFA across all cloud and SaaS access,” Tom adds.

“Second, establish the facts: review access logs to verify whether data was actually taken and how far the access reached.”

Are UK businesses ready to recover from cyberattacks like this?

“The honest answer is, some are, and some are still kidding themselves,” says Spencer Starkey , Executive VP EMEA at SonicWall .

“The businesses that are improving have stopped chasing best-in-class quadrant rankings and started asking a more practical question: can we mostly recover should something happen?

“Cyber defence and resilience isn’t having every feature. It’s being 80% covered and knowing that when something gets through, you can remediate fast.

“The number of organisations that are still fully patched but have no robust backup capability is staggering.

“It’s like at when you put your keys down. If you know where everything is, you’ll find them, but if there’s a problem, you’re running around looking for the keys to answer the door.

“You can do everything right on prevention and still have nothing to roll back to. So then your recovery time won’t be related to a technology problem, but rather an operational discipline problem.”

“It only takes one successful cyberattack or data breach for thousands, if not millions, of people to be put at risk,” notes Andy Ward , SVP International at Absolute Security .

“With the rise of AI, these threats are not only becoming smarter but faster, and it is inevitable that other UK businesses will face a threat at some point.”

“It is essential that UK businesses are prioritising cyber resilience to minimise disruption and potential downtime.

“With threats evolving faster than ever, organisations must implement real-time visibility into their IT environments to identify vulnerabilities, and respond to these incidents when they occur.”

Andy Ward VP International at Absolute Security

VP International at Absolute Security

Jonathan Lee Director of Cyber Strategy

Director of Cyber Strategy

Marie Wilcox VP of Marketing

Raghu Nandakumara Vice President, Industry Strategy

Vice President, Industry Strategy

Spencer Starkey Executive Vice President

Executive Vice President

Tom Exelby Head of Cyber Security

Head of Cyber Security

Lightwell: How IBM & Red Hat Fixed 400+ Java Vulnerabilities Cyber Security

SHI: What Needs to Change in Enterprise Risk Management? Cyber Security

How Exabeam's Nova AI Triages Cases 30x Faster Than Humans Cyber Security

Cybersecurity Awareness Month: Don’t Make It Easy For Them Cyber Security