ASOS investigates unauthorized access after hacker alert

Users of the ASOS app received a push notification on Tuesday morning (6th) at around 10 AM London time, titled "ASOS hacked." The message, according to screenshots shared by customers and reported by the British press, was addressed to the company itself: "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it." The message directed recipients to a Telegram account.

Hours later, the online fashion retailer confirmed "unauthorized activity." In a statement, ASOS stated that it is investigating "unauthorized activity involving third-party platforms we use to communicate with customers" and that it took "immediate action to restrict access to notification platforms." The company asserted that basic personal data, such as names and contact information, "may have been accessed," but it does not believe that card details or passwords were affected. ASOS apologized to customers and stated it is working with both internal and external specialized advisers as well as "all relevant authorities."

What is confirmed and what is alleged

ASOS confirms the unauthorized sending of the notification and the investigation into third-party communication platforms. The group responsible for the message claims to have "fully" compromised ASOS's instance on Snowflake, the cloud data platform used by thousands of companies, threatening to leak content. This allegation has not been independently verified. ASOS had not publicly commented on the specific assertion that its instance on Snowflake was compromised by the time this article was published.

Snowflake, for its part, stated that it has initiated an investigation following the notification and found "no compromise" of its platform. The distinction matters: a customer account on Snowflake can be accessed with stolen credentials without the platform itself being breached.

The 2024 precedent

This was precisely the pattern of the campaign that affected Snowflake customers in 2024. At that time, Mandiant attributed the attacks to the group UNC5537, which used stolen credentials from infostealer malware to access accounts without multifactor authentication. About 165 organizations were notified as potentially exposed, including AT&T, Ticketmaster, and Santander. The investigations concluded that Snowflake's infrastructure was not breached, but the default access configuration placed the responsibility for credential security on the customer. Subsequently, the company began requiring MFA by default for new accounts.

The ASOS case does not yet allow us to assert whether the script is repeating itself. What the notification concretely shows is that attackers had sufficient access to a customer communication tool to send a mass message via the brand's official channel. For a retailer, this channel is commercially active: it is where promotions, delivery alerts, and, in the event of an incident, customer guidance are sent out.

Second incident in a few months

This is not ASOS's first security problem in 2026. In letters dated August 21, ASOS US Sales LLC informed American customers that it detected unusual activity in accounts on July 28, attributed to credentials obtained outside the company, in what experts classified as a credential stuffing attack. According to a survey by the law firm Srourian, around 138,828 individuals were affected, with exposure of names, addresses, phone numbers, and partial card data.

The two incidents are different in nature, and there is no public indication of a connection between them. Together, however, they place the retailer under scrutiny from regulators in two markets: the ICO in the UK, where the company is headquartered, and state authorities in the United States, where the August notification was made. Under the UK GDPR, incidents posing a risk to data subjects must be reported to the ICO within 72 hours.

The blind spot of engagement tools

For CISOs of retail and financial services, the incident exposes a category of supplier that often falls outside the critical risk inventory: push, email marketing, and CRM platforms, connected to customer databases and authorized to communicate on behalf of the brand. These tools are typically procured by marketing, integrated into data warehouses like Snowflake, and operated with service credentials that rarely go through the same rotation cycle as core systems.

The reputational damage from such an attack occurs before any data leaks. Customers in various markets received the word "hacked" on their phones signed by the brand, and the company's first response came hours later, through the press. The next review of contracts with engagement suppliers should include a question that few retailers were asking: who, besides marketing, can press the send button?