At around 10 a.m. UK time on October 6, thousands of ASOS app users' phones lit up with the same push notification: "ASOS HACKED." The body was addressed to ASOS itself: "Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it." — followed by a link to a Telegram channel. Instead of sending a ransom note by email, the attackers hijacked the retailer's own official push channel to broadcast it. Jake Moore, global cybersecurity adviser at ESET, called it "one of the most visible hacks in history."
ASOS issued a statement that afternoon confirming an "unauthorised customer notification" had gone out around 10 a.m., saying it was investigating "unauthorised activity involving third-party platforms that we use to communicate with customers," had "taken immediate action to restrict access," and was working with internal and external specialists "as well as all relevant authorities." The company admitted "basic personal information, including name and contact details may have been accessed," but said it did not believe "payment-card information or account passwords were impacted." The website and app kept operating normally with no disruption to operations. ASOS also disclosed it holds cyber security insurance with a large global provider, including business continuity cover, but said it was "too early to quantify any potential impact on trading."
ASOS shares fell more than 11% on Tuesday. The British fast-fashion giant, which serves about 17 million customers across more than 150 countries, had risen more than 60% so far this year — a large chunk of that vanished in a day. The fact the attackers could send a push notification shows they reached at least some of ASOS's connected systems, Moore noted, though that alone doesn't prove their claim of a "full compromise" — how much of the Snowflake data platform was actually taken awaits the investigation. The linked Telegram channel, called the "Xuanye group gateway," had 316 subscribers at last count.
Snowflake is a widely used cloud data platform where companies centralize their databases — and it is no stranger to attackers. In May 2024, hackers used credentials harvested by infostealer malware to log directly into Snowflake tenants that had not enforced multi-factor authentication, in one of the largest known incidents. In August 2026, security researchers at Wiz, part of Google Cloud, found a critical script-injection vulnerability in one of Snowflake's public GitHub repositories through its HackerOne disclosure program. Whether ASOS becomes the next big "Snowflake case" depends on the investigation. UK law requires companies to notify users after a "high-risk" attack — ASOS's next statement will decide whether its 17 million customers need to change passwords and watch their statements.