Asos customers received an alarming notification on Tuesday morning claiming the UK-based fashion retailer had been hacked. The message said the company’s cloud services had been compromised and threatened to release stolen data.
The notification was sent through Asos’s mobile app without authorization. The incident has raised concerns about whether customer information was exposed, although Asos said it does not believe payment card information or account passwords were impacted.
The company has 16.5 million customers, and 49% of its revenues came from those customers in the first half of its latest financial year. That scale helps explain why the notification caused such a strong reaction in financial markets, with Asos shares falling by more than 10% on Tuesday and diving almost 12% after the incident.
What the threatening message said
The message referred to Snowflake, a cloud service provider whose tools have been used by dozens of firms to collect, analyze, and store data. It was addressed to Asos’s data protection officer and IT team, and claimed that attackers had taken control of the company’s Snowflake instance.
The cyber attackers wrote: “Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us or we will leak it.”
That claim has not been confirmed. Snowflake launched an investigation after the notification appeared and said it found no compromise of its platform. A Snowflake spokeswoman said, “The investigation is ongoing and we will provide further updates as soon as more information becomes available.”
The reference to Snowflake has focused attention on the way companies use outside cloud platforms to hold and manage data. Asos said it is investigating unauthorized activity involving third-party platforms used to communicate with customers, rather than confirming that its core customer records or Snowflake itself were breached.
Asos restricts access while officials offer help
Asos said it took immediate action to restrict access to the notification platforms involved in the incident. The retailer is working with internal and external specialist advisers, as well as the relevant authorities, while it examines how the unauthorized message was sent.
“We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers. We took immediate action to restrict access to the notification platforms and are working with our internal and external specialist advisers, as well as all relevant authorities,” Asos said.
The UK’s National Cyber Security Centre, part of GCHQ, offered Asos assistance. NCSC chief executive Dr Richard Horne urged anyone who received the message to avoid links and watch for follow-up scams that use the breach claim as a lure.
“Individuals who received the notification should not click on any suspicious links and should stay vigilant to suspicious messages that may seek to take advantage of news of the breach,” Horne said.
That warning matters because a threatening app notification can lead to more than one type of risk. Even when a company has not confirmed stolen passwords or payment details, attackers can use a public incident to send convincing messages that try to capture information from worried customers.
Customer data and the next steps
Asos has said it does not believe payment card information or account passwords were impacted. The company has not confirmed that other customer data was compromised, and the investigation remains open.
“Customer trust is incredibly important to us, and if the situation changes an update will be provided as appropriate,” Asos said. The retailer also has cyber security insurance with a large provider, though the investigation has not established what losses or costs, if any, the policy might cover.
Snowflake’s finding that it found no compromise of its platform leaves an important question unresolved: whether the attackers accessed Asos data through another third-party notification system, or whether the message was sent without the claimed breach taking place. Asos’s statement points to unauthorized activity involving communication platforms, but does not identify the platform or explain how access was obtained.
The incident has already affected Asos’s share price, but its wider impact will depend on the investigation’s findings. For customers, the immediate advice is simple: do not click suspicious links, treat unexpected messages with caution, and wait for verified updates from Asos.
Both companies say the investigation is ongoing. Asos and Snowflake will provide further updates as more information becomes available.
Based on
- Asos hit by extortion hack that may have compromised some customer data — engadget.com
- Asos customers receive ‘hack’ notification threatening leak | Asos | The Guardian — theguardian.com
- Asos says customer data may have been accessed after ‘unauthorised activity’ | The Independent — independent.co.uk
- Asos users receive pop-up notification apparently sent by hackers – BBC News — bbc.com
