ASOS confirms breach after hackers push extortion alerts to app users

UK fashion retailer ASOS confirmed a data breach on 6 October 2026 after hackers sent unauthorised push notifications through its mobile app, claiming to have stolen customer data from the company's Snowflake environment. The notifications, which began appearing at approximately 5:00 a.m. ET, read: "Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it."channelnewsasia.com+1

ASOS said third-party platforms used to communicate with customers were accessed without authorisation, and that basic personal information including names and contact details may have been exposed. The company is now displaying an in-app notice telling customers to disregard the unauthorised push alert and not to click the external third-party link it contained. This matters because the attackers used ASOS's own notification system to deliver the threat directly to shoppers' phones.

What ASOS confirmed

ASOS said it does not believe payment-card information or account passwords were impacted, and that its website and app were operating as usual with no disruption to operations. The company took immediate action to restrict access to the notification platforms and is working with internal and external specialist advisers, as well as relevant authorities. ASOS holds cyber insurance, including basic continuity insurance, but said it was too early to quantify any impact on trading.

A hacking group calling itself the "Xuanye group" claimed responsibility, directing recipients to a Telegram channel. In messages posted on Tuesday morning, the group claimed the breach did not affect payment information, then published a "FINAL STATEMENT" claiming it had stolen customer information. The group did not disclose what information was taken, how many customers were affected, or provide evidence that it had compromised ASOS's Snowflake environment.

Shares in ASOS fell 10% on Tuesday, dropping as much as 14% to 432p. Before the fall, shares had risen by about 53% so far in 2026, and were up more than 60% year-to-date according to one report. ASOS is a FTSE 250 company whose largest shareholder is Mike Ashley's Frasers Group, with an interest of roughly 29%. The company reported total active customers of 16.4 million for the year to the end of August.

Where the numbers came from

Snowflake, the US cloud data platform named in the alert, said it launched an investigation as soon as it became aware of the notification. A Snowflake spokesperson said: "At this time, we can report that we have found no compromise of the Snowflake platform." Snowflake tools are used by thousands of companies. In 2024, Google's cybersecurity unit Mandiant detailed a hacking spree targeting Snowflake data associated with at least 165 customers.

Alan Woodward, a professor of cybersecurity at Surrey University, said the hackers "have probably … got access to the database," and that if he were an ASOS customer he would assume someone had his personal data. He also said that if the attacker had only compromised the marketing or push notification system, the alert could be an attempt to force ASOS to pay a ransom quickly, damaging the brand and stock price whether or not the leak claim is true.

Marijus Briedis, chief technology officer at NordVPN, called the message "an unusually brazen and threatening message," and said customers should not assume their personal or payment information has been stolen at this stage. Charlotte Wilson of Check Point advised people to be extremely suspicious of messages claiming their ASOS account has been compromised. The National Cyber Security Centre's guidance says customers should contact an affected organisation through its official website, not links in messages.

What remains unconfirmed

ASOS has not confirmed the threat actor's claim that its Snowflake environment was compromised, and has not disclosed how many customers may be affected. The company said it was still investigating and had yet to determine the cause of the alert. The Xuanye group's Telegram channel is new and does not match any known hacking group, and the only contact point for the attackers required payment.

If confirmed, the incident would follow attacks on Marks & Spencer and the Co-op in spring 2025, and the attack on Jaguar Land Rover, which the Cyber Monitoring Centre estimated caused a £1.9bn impact. ASOS is pursuing a turnaround plan under chief executive José Antonio Ramos Calamonte, and in a recent trading update said it expected adjusted earnings above the midpoint of its £150m to £180m guided range for the year.