ASOS says contact details may have been accessed after rogue customer alert
ASOS has confirmed a cyber incident after an unauthorised notification was sent through a customer communications channel, but the retailer has not verified the message’s broader claims about a Snowflake compromise and stolen customer data.
The notification reached some ASOS customers at around 10am UK time on 6 October 2026. ASOS subsequently said it was investigating unauthorised activity involving third-party platforms used to communicate with customers and had restricted access to the notification platforms involved.
The company said basic personal information, including names and contact details, may have been accessed. It did not believe payment-card information or ASOS account passwords were affected. As of 7 October, however, ASOS had not disclosed how many people or records were involved or whether information had been viewed, copied or removed.
ASOS also said its website and app were operating normally, with no current disruption to its operations. Continued availability does not rule out unauthorised access to data or administration tools. Equally, the rogue notification is not evidence that the complete app environment, payment systems or core retail operations were compromised.
What the Snowflake claim does and does not establish
The unauthorised message claimed that an ASOS Snowflake instance had been fully compromised and threatened a data leak. BleepingComputer reported that a sender using the Xuanye Group name also claimed customer information had been stolen. Neither the sender’s identity nor its claims about access and data theft had been independently verified at the research cutoff.
ASOS had not confirmed that a Snowflake account formed part of the incident, nor had it named the affected third-party platforms or explained the access method. The confirmed facts therefore establish misuse of customer communications tooling and possible access to basic personal information, not a confirmed theft from Snowflake.
Computing reported that Snowflake had found no evidence its own platform had been breached and was continuing to investigate. That statement addresses a different technical scope from the message’s claim. Compromise of an account managed by a Snowflake customer would not necessarily mean that Snowflake’s underlying platform had been breached, but there is not yet public confirmation that either occurred here.
The ability to send a message through a trusted ASOS channel is significant because recipients may reasonably treat such alerts as authentic. On its own, however, control of a notification channel does not establish access to a customer database, the broader ASOS network or any particular cloud service. ASOS has not published forensic findings that would settle those questions.
What ASOS customers should do
ASOS instructed customers to disregard the unauthorised notification and not click or engage with its external link. At the time of its guidance, the company was not asking customers to change their ASOS passwords.
The UK National Cyber Security Centre took a broader precautionary position. In an alert published on 6 October, it advised all ASOS customers to act on the assumption that they were affected, including people who did not receive the notification, and to remain alert for suspicious messages. That advice does not mean every customer was confirmed as affected.
Names and contact details can make phishing or impersonation attempts appear more convincing, even where passwords and card information are not involved. Customers should therefore treat unexpected messages claiming to concern ASOS orders, accounts or the incident with care, avoid suspicious links and review their account activity. No follow-up phishing campaign linked to this incident had been documented in the research available by 7 October.
The NCSC also recommended passkeys, or strong and separate passwords protected with two-step verification, as general account safeguards. This sits alongside ASOS’s more specific position that it was not then requesting an ASOS password change. Customers should follow subsequent official guidance because the investigation remained active.
Key questions remain unanswered
ASOS says it has 16.5 million active customers across more than 100 markets, but that figure describes the company’s overall scale. It must not be treated as the number affected by this incident. ASOS had not disclosed the geographical distribution of customers who received the alert or whose information may have been accessed. No Australian-specific affected count, direct notification or regulator action had been established by 7 October.
The retailer also had not identified the third-party communications platforms, the route used to gain access, the duration of the activity or whether access persisted after the platforms were restricted. There was no confirmed account of data exfiltration, and the party responsible had not been authoritatively identified.
ASOS said it had cyber security and business continuity insurance and that it was too early to quantify any potential effect on trading. It said its website and app remained available without current disruption, while its incident response included restricting access to the notification platforms.
Further updates would need to clarify whether the access was confined to messaging tools or extended to customer records or other systems. Until ASOS publishes further findings, customers have reason to be vigilant about suspicious communications. The available evidence does not support assuming that payment details, passwords or every customer account was compromised.
Delivery through a trusted customer channel can make a message appear authentic without settling the incident’s wider technical scope. Broaden your security foundations with The Hack Academy’s online cybersecurity training programme, which offers self-paced study in cybersecurity fundamentals and networking, with practical exercises alongside theory.
