On Tuesday, October 6, 2026, shoppers received an unauthorized “ASOS HACKED” app notification around 10 a.m. It addressed ASOS’s data protection officer and IT staff, claimed attackers had fully compromised its Snowflake environment, and threatened a leak unless ASOS contacted a “Xuanye gateway” Telegram channel. The notification was real; its claim of full Snowflake compromise remains unverified. 4912

• What ASOS confirmed: It was investigating unauthorized activity involving third-party platforms used to communicate with customers. Names and contact details may have been accessed, but ASOS said it did not believe payment-card information or account passwords were affected. That is a preliminary assessment, not a finding that no customer data was exposed. 3811
• Response: ASOS apologized in an Instagram Story and told customers to disregard the alert and avoid its link. It said it had restricted access, was working with outside specialists and relevant authorities, and that its website and app remained operational. Reports said the UK’s National Cyber Security Centre offered assistance with the investigation. 45812
• What the experts’ assessments mean: NordVPN’s Marijus Briedis and Check Point’s Charlotte Wilson distinguished the demonstrated ability to send an app notification from proof of access to ASOS’s Snowflake data; the conspicuous message could also be a tactic to embarrass or pressure the company. Malwarebytes’ Pieter Arntz noted an indirect possible connection: ASOS uses marketing provider Simon AI, which runs on Snowflake. That does not establish that Simon AI or Snowflake was breached. Browsing and buying habits, location, and loyalty status are potential categories of concern, not confirmed accessed data. 579
• Scale and obligations: ASOS’s roughly 17 million customers across 150 countries indicate the possible reach, not the number whose information was compromised. Under UK rules, a personal-data breach likely to pose a risk to people must be reported to the ICO without undue delay and, where feasible, within 72 hours of awareness; if it is likely to pose a high risk, affected people must also be informed without undue delay. Whether those thresholds apply to particular customers depends on what the investigation establishes. 510
• Practical risk: Even if passwords and cards were unaffected, exposed contact details could help criminals send convincing follow-up emails or texts seeking passwords or payments. Customers should avoid the notification’s link and verify any purported ASOS message through the app or website they open themselves. 711

On Tuesday, October 6, 2026, shoppers received an unauthorized “ASOS HACKED” app notification around 10 a.m. It addressed ASOS’s data protection officer and IT staff, claimed attackers had fully compromised its Snowflake environment, and threatened a leak unless ASOS contacted a “Xuanye gateway” Telegram channel. The notification was real; its claim of full Snowflake compromise remains unverified. 4912

• What ASOS confirmed: It was investigating unauthorized activity involving third-party platforms used to communicate with customers. Names and contact details may have been accessed, but ASOS said it did not believe payment-card information or account passwords were affected. That is a preliminary assessment, not a finding that no customer data was exposed. 3811
• Response: ASOS apologized in an Instagram Story and told customers to disregard the alert and avoid its link. It said it had restricted access, was working with outside specialists and relevant authorities, and that its website and app remained operational. Reports said the UK’s National Cyber Security Centre offered assistance with the investigation. 45812
• What the experts’ assessments mean: NordVPN’s Marijus Briedis and Check Point’s Charlotte Wilson distinguished the demonstrated ability to send an app notification from proof of access to ASOS’s Snowflake data; the conspicuous message could also be a tactic to embarrass or pressure the company. Malwarebytes’ Pieter Arntz noted an indirect possible connection: ASOS uses marketing provider Simon AI, which runs on Snowflake. That does not establish that Simon AI or Snowflake was breached. Browsing and buying habits, location, and loyalty status are potential categories of concern, not confirmed accessed data. 579
• Scale and obligations: ASOS’s roughly 17 million customers across 150 countries indicate the possible reach, not the number whose information was compromised. Under UK rules, a personal-data breach likely to pose a risk to people must be reported to the ICO without undue delay and, where feasible, within 72 hours of awareness; if it is likely to pose a high risk, affected people must also be informed without undue delay. Whether those thresholds apply to particular customers depends on what the investigation establishes. 510
• Practical risk: Even if passwords and cards were unaffected, exposed contact details could help criminals send convincing follow-up emails or texts seeking passwords or payments. Customers should avoid the notification’s link and verify any purported ASOS message through the app or website they open themselves. 711