ASOS data breach: what happened and what customers should do now
A hijacked employee login let attackers push a rogue “hacked” notification to ASOS app users and reach customer data. Payment details were not affected, but anyone with an ASOS account should expect convincing phishing in the weeks ahead.
By OwnYourStack Admin · Published
On 6 October 2026, ASOS app users received an odd push notification. It appeared to be addressed to the retailer’s own data protection officer and IT team, claimed that a Snowflake database had been compromised, and pointed to a Telegram channel. It was not a prank: ASOS confirmed a data breach the same day in a statement to the London Stock Exchange, and emailed customers two days later.
What ASOS has confirmed
In its email to customers on 8 October, ASOS said the attacker had accessed personal and customer account data. The company stressed that payment information was not compromised and that the incident had not affected its operations.
The way in was low-tech. According to ASOS, the attacker obtained an employee’s login credentials by impersonating a trusted contact, then used them to reach certain third-party platforms that ASOS uses to communicate with customers. That access is what allowed the legitimate-looking push notification to be sent through the official app.
Was Snowflake hacked?
No, according to Snowflake. The cloud data company told Infosecurity Magazine that the incident did not result from any weakness or misconfiguration on its platform, and that its customers need take no action. A researcher at Malwarebytes suggested a possible indirect link with Simon AI, an AI marketing platform used by ASOS that is built on Snowflake technology, and the attacker told the BBC that a Simon AI instance had been compromised. Those claims had not been independently confirmed at the time of writing.
What data may be involved
ASOS initially referred to basic contact details. However, the BBC reported that a sample sent to it by the attacker contained more: names, postal addresses, phone numbers, email addresses, customer numbers and even search terms typed on the website. The BBC did not say whether the sample had been verified by independent experts, so treat the full scope as unconfirmed until ASOS says otherwise.
What to do if you have an ASOS account
Because card details were not taken, the main risk is not direct fraud on your account but targeted phishing. A message that quotes your real name, address and order history is far more convincing than generic spam.
- Be suspicious of any message about the breach. Emails, texts or calls offering “compensation”, “refunds” or “account verification” are a classic follow-up to a breach. Go to the ASOS app or website directly instead of clicking links.
- Change your password if you reused it. ASOS has not said passwords were taken, but if your ASOS password is used anywhere else, change it on those sites first. A password manager makes unique passwords painless.
- Turn on two-step verification on your email account above all: whoever controls your inbox can reset almost everything else.
- Report scam emails to the National Cyber Security Centre by forwarding them to report@phishing.gov.uk, and scam texts to 7726.
- Check whether your address appears in known breaches with a service such as Have I Been Pwned, and keep an eye on it over the coming weeks.
The wider lesson
This incident follows a familiar pattern seen across UK retail since 2025: attackers rarely need a technical exploit when they can talk an employee out of their credentials. It also shows how many third-party platforms now sit between a retailer and its customers, each one another place where personal data lives. For individuals, the defence remains the same: unique passwords, two-step verification and a healthy distrust of urgent messages.
