ASOS investigates hacking alert and data leak threats

A threat sent through the app

Thousands of ASOS customers, including in Spain, received a notification in the retailer’s app claiming that cybercriminals had compromised a Snowflake instance and threatening to leak information unless the company contacted them. The message included a link to a Telegram channel attributed to the attackers.

The alert was real; the intrusion and alleged data theft, however, had not been confirmed. ASOS was investigating whether unauthorized access had occurred and what its scope might be. The company’s platform and app continued to operate, according to reports on the incident.

What is—and is not—known about Snowflake

Snowflake is a cloud platform that companies can use to store, process, and analyze data. The fact that attackers mention an instance of that service does not establish that they accessed customer information or compromised ASOS’s sales systems.

Cybersecurity expert Rob Demain, CEO of e2e-assure, noted that the claim of an attack came from the alleged attackers themselves and was therefore not enough to prove it had happened. He also raised the possibility that, if confirmed, the incident might have been limited to marketing or customer communications systems. That hypothesis does not establish that other systems or data were safe: the scope remained unknown.

Messages attributed to the extortionists claimed that payment information was not affected, but there was no independent confirmation of that claim either. So far, it had not been established what information, if any, may have been exposed.

Risks for the company and its customers

The arrival of a threat through an official channel raises an additional operational question: how the notification could have been sent. The use of the app does not in itself prove that ASOS’s entire infrastructure was compromised, but it makes it important to investigate both the systems that manage notifications and their connections to databases.

The episode may also create favorable conditions for impersonation attempts. Marijus Briedis, chief technology officer at NordVPN, warned that high-profile incidents can facilitate phishing campaigns. For companies, this underscores the importance of verifying alerts and communications before sharing conclusions about a breach, and of communicating clearly once facts have been confirmed.

Investigation ongoing and market impact

ASOS’s response was still under investigation at the time of the reports. According to those reports, the UK National Cyber Security Centre offered the company assistance. No definitive findings had been published about the origin of the message, access to Snowflake, or a potential leak.

ASOS shares fell during the London trading session after the alert was reported. Reports cited declines of more than 10%, although the share price moved during the day. That reaction reflects the market’s immediate response to the news, but does not confirm that an intrusion occurred or make it possible to predict its financial or regulatory effects.

In the UK and for customers in other countries, the company’s specific obligations would depend on the facts established by the investigation and the applicable regulations. Until it is determined whether access occurred and which data might be involved, it is not possible to specify the scope of a potential breach or its legal consequences.