ASOS investigates unauthorized notification and possible access to customer data

On October 6, 2026, ASOS customers received an unauthorized notification in the company’s app with the headline “ASOS HACKED.” The message claimed that the senders had compromised a Snowflake instance and threatened to leak information. The company confirmed that the notification had been sent and that it was investigating unauthorized activity on third-party platforms used to communicate with its customers.

The message’s appearance in a legitimate brand channel distinguishes the incident from a threat published only on social media: it shows that a customer-facing communication channel was used without authorization. However, this alone does not prove that the senders accessed Snowflake, nor does it establish which systems or data may have been exposed.

What the company has confirmed and what remains unknown

ASOS said that personal data, including names and contact details, may have been accessed. According to the information available, the company does not believe payment card data or account passwords were affected. It also said that it had restricted access to the notification platforms and was working with internal and external specialists and the relevant authorities. Its website and app remained operational.

On October 9, Malwarebytes published an update reporting the theft of customer data, including shopping searches. This adds to what is known about the information that may have been affected, but the update does not publicly specify the volume of data or how many people may be affected. Nor does it confirm that the Snowflake instance mentioned in the notification was breached or how access occurred. References to Snowflake and to a group that claimed responsibility for the message came from the senders themselves; they do not constitute independent verification of their authorship or of all their claims.

An incident that puts the spotlight on technology providers

The investigation focuses on third-party platforms that ASOS uses to communicate with its customers. The case highlights an operational challenge for companies: an issue with external tools can affect channels that users recognize as belonging to the brand. Even so, the published information does not establish how access was obtained or whether the activity originated with a particular provider.

For organizations, the distinction matters: misuse of a notification channel is confirmed, and Malwarebytes later reported the theft of customer data, including shopping searches. The full scope of the incident, the method of access, and the relationship between the reported theft and the alleged intrusion into Snowflake remain unclear. The available information also does not make it possible to determine the number of people affected or the total volume of potentially accessible data.

ASOS said it would provide updates if the situation changed. The investigation remains relevant to clarifying details that have not been made public; in the meantime, conclusions about the scope should distinguish between what ASOS has communicated and what Malwarebytes’ update reports.