ASOS says customer data may have been accessed in 'hack'

ASOS says customer data may have been accessed in a suspected hack that saw thousands of app users receive a notification claiming the company’s data systems had been compromised.

A push notification appeared on the screens of users of the fashion firm’s mobile application on Tuesday, October 6, which read “ASOS HACKED”.

It then appeared to threaten the app’s owners over a possible “leak” addressed to the ASOS data protection officer (DPO) and IT department.

A push notification appeared on the screens of users of the mobile application on Tuesday, October 6, which read "ASOS HACKED". — A push notification appeared on the screens of users of the mobile application on Tuesday, October 6, which read “ASOS HACKED”. STV News

The message read: “Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us or we will leak it.”

On Tuesday afternoon, the company confirmed that an “unauthorised customer notification” had been sent out through its mobile app.

In a statement, the company said: “We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers.

“We took immediate action to restrict access to the notification platforms and are working with our internal and external specialist advisers, as well as all relevant authorities.

“Our website and app are operating as normal, with no current disruption to any aspects of our operations.

“Customer trust is incredibly important to us, and if the situation changes an update will be provided as appropriate.”

Snowflake is an American cloud-based platform which provides companies with data analysis.

In 2024, hundreds of Snowflake customers were targeted in a mass data theft and extortion campaign.

Snowflake said that there is “no compromise” of their platform.

A spokesperson said: “As soon as we became aware of the notification that is currently being reported, we began an investigation.

“At this time, we can report that we have found no compromise of the Snowflake platform. We take customer privacy and security very seriously. The investigation is ongoing and we will provide further updates as soon as more information becomes available.”

Marijus Briedis, chief technology officer at NordVPN, said: “This is an unusually brazen and threatening message.

“The attackers aren’t simply claiming to have breached Asos – they’re publicly telling the company to engage with them or they will leak what they say they have obtained.

“What customers should be particularly alert to now is what happens next. High-profile cyber incidents create ideal conditions for phishing attacks.”