ASOS confirmed on Thursday, October 8, 2026, that hackers accessed some customer data through a third-party platform and hijacked the retailer’s app to send an unauthorized warning notification.
The incident became public after customers received a push alert addressed to ASOS’s data-protection and information-technology teams. The message claimed attackers had fully compromised data linked to the retailer’s Snowflake environment and threatened to release it unless ASOS engaged with them. ASOS said the compromised third-party service was used to communicate with customers, while investigators examined how the attackers gained access.
The company has said names and contact details may have been exposed, with reports indicating that some affected records could also contain addresses, phone numbers, email addresses and customer-profile notes. ASOS has not said how many customers were affected or confirmed the full range of stolen information. Investigators have linked the intrusion to social engineering and stolen credentials, although important details about the attack remain unclear.
The retailer said it restricted access to the notification platforms and was working with specialists and authorities. ASOS currently says it has no evidence that payment-card information or account passwords were compromised and advised customers not to click the alert’s external link.