On the morning of Tuesday, October 6, ASOS app users opened their phones to a push notification titled “ASOS HACKED.” The ASOS data breach that followed has been unusual from the start: the attackers broke in, then used the retailer’s own customer-messaging tools to announce it, sending a note that read, “Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.”
Where it stands: ASOS has since tied the incident to a hijacked employee account and says names, contact details and some account information were reached, but not card numbers or passwords. It has not said how many customers are affected. Reports say the group behind the notice wants a ransom.
What ASOS has confirmed about the ASOS data breach
The company’s first statement, emailed to Newsweek that Tuesday, confirmed that “an unauthorised customer notification was sent to ASOS customers” around 10 am that morning. Cyber Daily says the alert reached app users “in the UK, Australia, France, Sweden, and the Republic of Ireland, according to local reports.”
ASOS also told Newsweek: “Basic personal information including name and contact details may have been accessed. We do not believe that payment-card information or account passwords were impacted.” BleepingComputer reported the same day that the compromised systems were third-party platforms the retailer uses to communicate with shoppers.
Two days later, a fuller explanation went out. According to the security notice BleepingComputer saw, “We discovered that an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain log in credentials.” Retail Gazette quotes the next line: “Those credentials were then used to access information on certain third-party platforms used by ASOS.”
What was taken: ASOS’s account versus the BBC’s
This is where the story splits. ASOS’s own description stays narrow. Its update, quoted by Retail Gazette, says the intruder “had access to some personal information, including names and contact details, and certain non-personal account related information.”
The hackers tell a fuller story. They shared a sample with BBC News, and TechCrunch reports the BBC saw “home addresses, phone numbers, and email addresses, as well as notes relating to customer profiles, such as their website search queries.” Neither version has been independently verified in full.
| Data | ASOS says | BBC sample, per TechCrunch |
|---|---|---|
| Names | Accessed | Included |
| Contact details | Accessed | Phones and emails included |
| Home addresses | Not specified | Included |
| Search history notes | “Non-personal” account data | Included |
| Card details, passwords | Not affected | Not reported |
Search history sounds trivial, but it is the sort of detail that makes a scam believable. A message that mentions the boots you looked at last week feels like it must come from the shop. Malwarebytes puts it well: “A message that knows your name, or what you searched for, isn’t proof it came from ASOS.”
Snowflake, Simon AI and who the attackers are
The push alert pointed readers to a Telegram channel run by a group calling itself the “Xuanye group,” according to BleepingComputer. The group later told the BBC, per Malwarebytes, that it “accessed the information through Simon AI,” a personalization tool ASOS uses that runs on Snowflake.
Snowflake rejects any suggestion its platform was at fault. A spokeswoman told PA, as carried by Capital FM: “We can confirm this issue did not in any way result from a vulnerability, weakness, flaw, or misconfiguration with the Snowflake service, platform, or internal environments, and was not caused by Snowflake.” That fits ASOS’s own account, which centres on a stolen employee login rather than a software flaw.
The ransom angle remains reported rather than confirmed. Malwarebytes writes that the group reportedly “gave ASOS two weeks to make contact and said it wanted a ransom in exchange for deleting customer information. ASOS did not disclose whether it would pay.”
How many customers? Nobody has said
ASOS has not published a figure, and TechCrunch notes the attackers “have not indicated how much data they allegedly possess.” The often-quoted 17 million is the size of ASOS’s customer base according to its own website. It shows the scale of the business, not the number of people whose data was taken.
ASOS has said customers would be contacted again once the investigation finishes, with “additional steps” to tighten security already in place.
What ASOS customers should do
ASOS’s message to shoppers is reassuring on one point: “There is no action you need to take on your account.” Your password and saved cards are not believed to be exposed. The risk now is the follow-up scam, and the UK’s National Cyber Security Centre warns that criminals cash in on headline breaches whether or not your own record was taken: “the criminals will exploit high profile breaches (whilst they are still fresh in people’s minds) to try and trick people into clicking on scam messages.”
- Hold ASOS to its own rule. The company says: “We will never ask you to share passwords, security codes or payment details through an unsolicited message or call.” Anything that does is fake.
- Know the likely lures. The NCSC lists “official-sounding messages about ‘resetting passwords’, ‘receiving compensation’, ‘scanning devices’ or ‘missed deliveries’.” A breach “refund” or a parcel problem from a fashion retailer fits that pattern exactly.
- Go to the app, not the link. If an email about your order looks plausible, close it and check your order history in the ASOS app or a browser tab you opened yourself.
- Lock down the email account on file. Your contact details are the part that leaked. The US cyber agency CISA suggests you “Check to see whether your email accounts, banks, healthcare providers, and other important accounts offer MFA and enable it by default.” With multifactor authentication on, a phished password alone is not enough to get in.
- Change shared passwords. ASOS passwords were not affected, but if you reuse one across shopping sites, now is a good time to stop.
For how retailers handle these notices and why loyalty data differs from payment data, see our explainer on retail breach notices and the accounts they cover. Readers who want a refresher on spotting fakes can start with our phishing basics guide.
Frequently Asked Questions
What data was stolen in the ASOS data breach?
ASOS says the intruder had access to names, contact details and some non-personal account information. BBC News, as reported by TechCrunch, says a sample shared by the hackers also included home addresses and notes such as website search queries. ASOS says payment card details and account passwords were not affected.
How many ASOS customers were affected?
ASOS has not said. The hackers have not said how much data they hold either. ASOS has about 17 million customers according to its website, but that is the size of its customer base, not a count of people affected.
Do I need to change my ASOS password?
ASOS told customers there is no action they need to take on their accounts and that passwords were not affected. If your ASOS password is the same as one you use elsewhere, changing it on those other accounts is still sensible.
Was the ASOS breach a Snowflake hack?
The push notification named Snowflake, but Snowflake says the issue did not result from any flaw or misconfiguration on its platform. ASOS links the breach to an employee whose login was obtained by an attacker posing as a trusted contact.
Is an email about the ASOS breach real?
It may be, but check before acting. ASOS says a genuine message from it will not ask you to hand over a password, a security code or card details out of the blue. Open the ASOS app or website yourself instead of following a link.
Sources
- ASOS confirms data breach after “HACKED” in-app notifications — BleepingComputer (Lawrence Abrams), October 6, 2026
- Ominous warning sent to ASOS users’ phones: what happens now — Newsweek, October 6, 2026
- ASOS confirms cyber incident following app notification sent by threat actors — Cyber Daily (Daniel Croft), October 2026 (week of October 6)
- ASOS links data breach to social engineering attack, credential theft — BleepingComputer (Bill Toulas), October 8, 2026
- ASOS update: hackers gained access to employee account — Retail Gazette, October 2026 (after the October 6 incident)
- Asos confirms breach of customer data after hackers send rogue app notification — TechCrunch (Zack Whittaker), October 8, 2026
- ASOS breach update: Hackers stole customer details and shopping searches — Malwarebytes (Pieter Arntz), October 9, 2026
- ‘Snowflake’ firm in ASOS hacking message issues response — Capital FM (PA), October 9, 2026 (Friday after the incident)
- Data breaches: guidance for individuals and families — UK National Cyber Security Centre (NCSC), undated guidance page, retrieved October 22, 2026
- Turn On Multifactor Authentication — Cybersecurity and Infrastructure Security Agency (CISA), undated archived guidance page, retrieved October 22, 2026
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.