ASOS customers across the UK and beyond opened their phones on Tuesday, October 6, 2026, to find a push notification nobody at the company had approved, an incident Insurance Business was among the trade outlets to report in detail. Sent through the retailer’s own official app, the alert was titled “ASOS HACKED” and addressed itself directly to ASOS’s data protection officer and IT department, claiming the attackers had “fully compromised” the company’s Snowflake data environment. By later in October 2026, ASOS had confirmed the “unauthorised activity” tied to the incident did result in customer-data access, with names and contact details among the information the company said was exposed.
The incident marks one of the more unusual breach disclosures of 2026 because of the delivery method: instead of a leaked database dump or a dark-web listing, the warning arrived as a legitimate-looking alert on the retailer’s own branded app, landing on an unknown but reportedly large number of devices simultaneously. Within hours, the story was running on the BBC, BleepingComputer, the Telegraph, Malwarebytes Labs, and CyberInsider, each describing a retailer caught having to explain, in near real time, how its own customer-communication channel became the attacker’s megaphone.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened: ASOS App Users Received a Hacker-Sent Alert
According to the BBC, the rogue notification appeared on ASOS app users’ screens at approximately 10 a.m. UK time on October 6. Early reporting, including from LBC, described the alert itself as reaching “thousands” of customers, but the BBC later reported that potentially millions of detailed customer profiles were affected by the underlying breach, a far larger scale than the initial notification reach suggested, with social-media reports on Reddit and elsewhere suggesting the notification system that fired may have touched a large share of the retailer’s active app install base.
What makes this incident distinct from a typical data breach disclosure is sequencing. Usually, companies control the narrative: a forensic review happens quietly, a statement goes out once lawyers and incident-response teams have signed off, and customers hear about the problem on the company’s terms. Here, the attackers set the timeline. By pushing their claim directly through ASOS’s own app, whoever was behind the notification bypassed every normal communications gatekeeper and put the words “ASOS HACKED” on customer lock screens before ASOS itself had a chance to say anything.
Inside the Message: What the Notification Actually Said
Per reporting from BleepingComputer and CyberInsider, the notification opened with the line “Dear Asos DPO and IT,” directly addressing the company’s data-protection and IT staff rather than its customers, even though it landed on customer devices. It went on to claim: “We have fully compromised the Snowflake instance,” followed by a demand framed as an ultimatum: “Engage with us, or we will leak it.” The message reportedly included a Telegram link, apparently intended as a channel for ASOS to negotiate with whoever sent it.
The Telegraph separately reported that the attackers set a two-week deadline for ASOS to respond before threatening to publish customer data, framing the incident as a ransom demand rather than a pure data dump. None of the outlets covering the story have independently confirmed the attackers’ identity, the exact ransom amount, or whether any payment has been discussed. ASOS itself has not confirmed those details publicly.
ASOS’s Official Response
ASOS acknowledged the incident the same afternoon, describing it as an “unauthorised customer notification.” A company spokesperson told Business Insider: “We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers.” In its formal customer notice issued in October 2026, ASOS said it had locked the affected third-party platforms, stating it “took immediate action to restrict access to the notification platforms and are working with our internal and external specialist advisers, as well as all relevant authorities.”
That phrasing is important. ASOS is not describing a breach of its core e-commerce infrastructure or payment systems. It is describing a compromise of a third-party platform used specifically to send customer communications, such as app push alerts and marketing messages. ASOS said, per TechCrunch, that payment-card information was not accessed, and told the BBC that account passwords were likewise not accessed. News.com.au reported that ASOS said its website and app remained safe to use and were “operating as normal,” with no ongoing disruption to shopping or checkout.
At the same time, ASOS did not rule out a data-exposure risk entirely. The company said that “basic personal information including name and contact details may have been accessed,” and the BBC later found that the reported exposed fields went further still, including addresses, phone numbers, emails, customer numbers, and birth dates. TechCrunch additionally reported that stolen profile notes included customers’ website-search queries, underscoring that this remains an open investigation rather than a closed one. That kind of hedged disclosure, confirming a security event while gradually expanding its confirmed scope, has become a familiar pattern across 2026’s breach cycle, visible in incidents like the DTU breach affecting 200,000 users and the Hyundai Capital hack.
The Snowflake Claim: Verified or Not?
The notification’s central claim, that attackers had “fully compromised the Snowflake instance,” is the detail most likely to alarm security teams given Snowflake’s role as cloud data-warehouse infrastructure for thousands of enterprises. But Snowflake itself has pushed back on the claim. A Snowflake spokesperson told the BBC: “We have found no compromise of the Snowflake platform.” The company repeated a near-identical denial to Business Insider, stating: “At this time, we can report that we have found no compromise of the Snowflake platform.”
That denial does not necessarily mean the attackers’ claim was entirely fabricated. Snowflake’s statement addresses its own platform, not whatever ASOS-controlled data, credentials, or integration pipeline the attackers may have actually accessed. In prior incidents, including the wave of 2025 attacks tied to stolen Snowflake customer credentials rather than a platform-level breach, attackers have historically compromised customer-side access tokens or connected third-party tools rather than Snowflake’s own infrastructure. ASOS’s own statement, pointing to “third-party platforms used to communicate with customers,” suggests the actual point of entry may sit outside Snowflake altogether, inside a marketing or notification vendor that ASOS uses, a pattern similar to what played out in last year’s Rockstar Games Snowflake-linked breach.
Timeline of the October 6 Incident
| Time / Date | Event | Source |
|---|---|---|
| ~10:00 a.m., Oct. 6, 2026 | Rogue “ASOS HACKED” push notification sent through the official ASOS app to customer devices | BBC |
| Morning, Oct. 6 | Customers begin posting screenshots of the alert on Reddit and social media | Malwarebytes Labs |
| Tuesday afternoon, Oct. 6 | ASOS publicly acknowledges an “unauthorised customer notification” and opens an investigation | Business Insider |
| Oct. 6, same day | Snowflake denies any compromise of its own platform | BBC |
| Oct. 6, afternoon | ASOS says it restricted access to the affected notification platforms | Business Insider |
| Oct. 6-7 | Telegraph reports a two-week ultimatum allegedly issued by the attackers | The Telegraph |
| As of Oct. 7 | No confirmed attacker identity, ransom figure, or total affected-user count published | CyberInsider, BleepingComputer |
How Attackers Likely Weaponized a Marketing Platform
Push notifications are typically dispatched through a specialized layer sitting between a retailer’s app and customers’ devices, often a third-party customer-engagement or marketing-automation vendor rather than code the retailer’s own engineers write and deploy directly. That separation is normally a convenience: marketing teams can schedule campaigns, segment audiences, and push alerts without touching core application code. It is also, as this incident shows, a separate attack surface with its own credentials, API keys, and access controls that sit outside a retailer’s primary security perimeter.
If attackers obtained valid credentials or an API token for whatever platform ASOS uses to fire push alerts, they would not need to breach ASOS’s checkout systems, payment processor, or core customer database at all. ASOS itself confirmed something close to this: the company said hackers gained access to an ASOS employee account in October 2026 by impersonating a trusted contact, a foothold attackers then likely used to compose and send a message through a channel customers already trust because it carries the ASOS name and app icon. That is precisely the profile ASOS’s own statement describes: a compromise of “third-party platforms used to communicate with customers,” rather than of ASOS’s primary infrastructure.
Why This Attack Vector Is Becoming More Common
Retailers increasingly stitch together a dozen or more third-party SaaS tools, covering email, SMS, push notifications, loyalty programs, and analytics, each with its own login credentials and API integrations. Every one of those integrations is a potential weak link, and attackers have learned that compromising a marketing or communications vendor is often easier than breaching a hardened e-commerce core, while still producing a highly visible, trust-damaging result. The same logic drove 2026 incidents such as the OneMain Financial breach and the Dropbox accounts compromised through a third-party Lenovo SSO integration earlier this year.
Scope of the Breach: What Data Is Actually at Risk
ASOS has drawn a careful line between what it considers confirmed, possible, and unlikely. The company says names and contact details may have been accessed, but has stopped short of confirming that a full customer database was exfiltrated. It has explicitly said it does not believe payment-card data or account passwords were impacted. No outlet covering the story, including the BBC, BleepingComputer, or the Telegraph, has published an independently verified total of affected accounts.
| Category | Status as of Oct. 7, 2026 |
|---|---|
| Names and contact details | May have been accessed, per ASOS statement |
| Payment-card information | ASOS says it does not believe this was impacted |
| Account passwords | ASOS says it does not believe this was impacted |
| Full Snowflake data environment | Compromise claimed by attackers; denied by Snowflake |
| Total number of affected customers | Not yet published by ASOS or independently confirmed |
| Website and app availability | ASOS says both are “operating as normal” |
| Ransom amount or attacker identity | Not confirmed by ASOS or law enforcement |
Historical Context: A Year of Notification-Channel and Data-Warehouse Attacks
The ASOS incident lands in the middle of a year defined by attacks that exploit the connective tissue between companies and their customers rather than core systems directly. Earlier in 2026, Tech Insider covered the DTU breach, which exposed data on 200,000 users and triggered a Danish regulatory investigation, and the fallout from that breach’s GDPR probe. The Rockstar Games Snowflake-linked breach showed how attackers can leverage data-warehouse access as a staging ground for broader supply-chain extortion, a dynamic directly echoed in the Snowflake claim embedded in Tuesday’s ASOS alert.
The broader pattern, attackers compromising a trusted communications or data-integration layer rather than brute-forcing a front door, has defined much of the retail and consumer-platform threat landscape this year. For readers tracking the wider Snowflake ecosystem’s security posture, the ongoing debate over Snowflake versus Databricks as enterprise data platforms has increasingly folded in questions about which vendor offers stronger default protections against credential-based attacks, rather than purely performance or cost comparisons.
Market and Investor Impact
ASOS has already faced investor scrutiny over cybersecurity this year. As Tech Insider previously reported, the retailer’s shares dropped 13% after an earlier hack threat rattled confidence in the company’s handling of customer data. Tuesday’s incident, arriving through a channel customers interact with daily, risks reigniting that same investor unease, particularly given how visibly and publicly the notification spread before ASOS could get ahead of the story.
Retail cybersecurity incidents increasingly carry a market cost distinct from the direct remediation bill. Breach-related reputational damage tends to compound when the disclosure method itself becomes the story, as happened here. A retailer explaining why its own app sent a threatening message to customers faces a different kind of scrutiny than one quietly disclosing a backend database exposure days or weeks after the fact.
Competitive Comparison: How Retailers Handle Similar Disclosures
ASOS is far from alone in facing a breach tied to third-party platforms or data-communication layers in 2026. The table below compares several recent incidents already covered on Tech Insider, each involving compromised customer-facing systems or data pipelines rather than a direct point-of-sale breach.
| Company | Incident type | Reported scope |
|---|---|---|
| ASOS | Rogue in-app push notification via third-party platform; Snowflake claim disputed | Names/contact details possibly accessed; total unconfirmed |
| DTU (Denmark) | Data breach triggering GDPR probe | 200,000 users affected |
| Hyundai Capital | Hack exposing loan-agent data | 146 loan agents affected |
| OneMain Financial | Breach spanning two states | 16,988+ individuals affected |
| Rockstar Games | Snowflake-linked breach via supply-chain access | Extortion threat tied to data-warehouse access |
The common thread across these cases is that the breach rarely starts at the most heavily defended system. It starts at the edges, in a vendor integration, a loan-agent portal, a university research system, or, in ASOS’s case, a customer-notification pipeline, where credentials and access controls are often less rigorously audited than the core product.
Expert and Industry Reaction
ASOS has so far limited its public statements to confirming the investigation and describing its immediate response. Speaking to Business Insider, an ASOS spokesperson said: “We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers,” adding, “We took immediate action to restrict access to the notification platforms and are working with our internal and external specialist advisers, as well as all relevant authorities.” (source)
Snowflake, named directly in the attackers’ message, issued its own denial to the BBC: “We have found no compromise of the Snowflake platform.” (source) The company repeated a similar line to Business Insider: “At this time, we can report that we have found no compromise of the Snowflake platform.” (source)
Those two statements, taken together, frame the open question at the center of this story: if Snowflake’s own platform was not compromised, the actual point of failure likely sits in a connected system ASOS or one of its vendors controls, something regulators and ASOS’s own forensic team are expected to detail as the investigation progresses.
Why Push Notifications Are Becoming a Trust Battleground
For years, security guidance around phishing focused on email and SMS, teaching users to scrutinize sender addresses and suspicious links. Push notifications occupy a different trust tier: they arrive through an app the user already installed and already trusts, often with no sender address to inspect and no obvious way to verify authenticity. When that channel gets hijacked, as appears to have happened with ASOS, the resulting message carries an unusual amount of built-in credibility, precisely because users have been trained to trust it.
That dynamic may explain why the ASOS notification spread so quickly across social media. A message claiming a company had been “fully compromised,” arriving through the company’s own verified app rather than a spoofed email, is a harder thing for an average customer to dismiss as a scam, even when, as in this case, the full extent of the claim remains unverified.
What ASOS Customers Should Do Right Now
While ASOS says it does not believe passwords or payment data were affected, customers concerned about the incident have a few reasonable, low-effort precautions available while the investigation continues:
- Watch for follow-up phishing attempts that reference the ASOS incident, since attackers often exploit breach headlines to craft convincing follow-on scams.
- Avoid clicking any Telegram links or external URLs claiming to offer more information about the breach, especially if received via unofficial channels.
- Enable multi-factor authentication on the ASOS account if not already active, even though ASOS says passwords are not believed to be affected.
- Monitor for unexpected marketing emails or texts, which could indicate contact details were indeed accessed.
- Check official ASOS channels directly rather than relying on forwarded screenshots of the notification for the latest confirmed information.
Predictions: What Happens Next
Based on how similar incidents have unfolded in 2026, several outcomes appear likely in the coming days and weeks:
- A formal regulatory inquiry is likely. UK data-protection authorities have opened investigations into comparable breaches this year, and a consumer-facing retailer with a hijacked communications channel is a natural candidate for scrutiny.
- ASOS will likely identify and name the compromised third-party vendor. Companies rarely leave “third-party platform” vague once forensic reviews conclude, as seen in the Dropbox-Lenovo and OneMain Financial disclosures.
- The Snowflake denial will probably hold up, with blame shifting to a connected integration. Given Snowflake’s firm public denial, expect the eventual root-cause finding to point at an API key, OAuth token, or vendor credential rather than Snowflake’s core platform.
- Expect a customer notification campaign from ASOS itself. Retailers facing this kind of exposure typically follow up with official emails or in-app messages confirming who was affected, partly to regain narrative control after the attacker-sent alert.
- Other retailers using similar marketing-automation stacks will quietly audit their own notification-platform credentials. Breach disclosures involving shared SaaS vendors tend to trigger defensive reviews industry-wide, even among companies not directly named.
The Bigger Picture for Retail Cybersecurity
The ASOS incident is a reminder that modern retail security extends well beyond the checkout page. A company can run a hardened payment system, encrypt its customer database, and still find itself the center of a breach headline because a marketing vendor’s API key leaked. As retailers lean further into personalized push alerts, SMS campaigns, and loyalty-app notifications to compete for attention, the attack surface tied to those systems grows in parallel, often without the same level of security investment given to core transaction infrastructure.
For an industry that has spent the past two years responding to Snowflake-credential attacks, SSO-integration breaches, and vendor-side compromises across sectors from financial services to logistics, the ASOS case adds a distinct wrinkle: it is one of the first high-profile 2026 incidents where the attacker’s message itself, not a leaked spreadsheet or dark-web post, was the primary evidence customers saw first.
Frequently Asked Questions
Was ASOS actually hacked?
ASOS has confirmed it is investigating “unauthorised activity” after a rogue notification was sent through its app, and has acknowledged that customer names and contact details may have been accessed. It has not confirmed the full scope of any breach, and Snowflake has denied that its own platform was compromised.
What did the ASOS hack notification say?
The message was titled “ASOS HACKED” and read, in part, “Dear Asos DPO and IT, we have fully compromised the Snowflake instance,” followed by a threat to leak data unless ASOS engaged with the senders via an included Telegram link.
Were passwords or payment information stolen in the ASOS breach?
ASOS says it does not believe payment-card information or account passwords were impacted. The company says basic personal information, such as names and contact details, may have been accessed.
Did Snowflake confirm a breach of its platform?
No. Snowflake told both the BBC and Business Insider that it found no compromise of its own platform, despite the attacker’s claim referencing a “Snowflake instance” in the rogue ASOS notification.
How many ASOS customers received the fake notification?
ASOS has not published an exact figure. Multiple outlets, including LBC, described the alert as reaching “thousands” of customers, based on widespread social-media reports, but no verified total has been confirmed.
Is the ASOS app and website still safe to use?
ASOS says its website and app are “operating as normal” with no reported disruption to shopping or checkout functions. The company has restricted access to the notification platforms believed to be involved in the incident.
What should ASOS customers do after this incident?
Customers should watch for follow-up phishing attempts referencing the breach, avoid clicking unofficial Telegram or external links claiming to have more information, consider enabling multi-factor authentication, and rely only on official ASOS communications for updates.
Has ASOS faced cybersecurity issues before 2026?
Yes. ASOS shares dropped 13% earlier this year following an earlier hack threat, reflecting ongoing investor sensitivity to the retailer’s cybersecurity posture ahead of this latest incident.
