Short answer: On the morning of October 6, 2026, thousands of ASOS customers received a rogue push notification claiming the retailer had been hacked, with a message addressed to the company’s data protection officer saying its Snowflake data instance was “fully compromised.” ASOS said it was aware of the reports and is investigating, but has not confirmed any breach. The claim remains unverified, and shoppers should treat it cautiously while taking basic account precautions — the same playbook we outlined for the Pentagon DMDC data breach earlier this month.
What exactly happened on October 6
Customers in the UK woke up on Tuesday morning to an unusual alert from the ASOS app. Instead of the usual news about restocks or sales, the push notification was titled “Asos hacked” and read: “Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.”
DPO refers to the company’s data protection officer, the executive legally responsible for safeguarding customer data. Snowflake is a US-based cloud data platform used by many large companies to store and analyze customer information. The notification included a link to a Telegram channel called the “Xuanye Gateway,” which did not match any previously known hacking group.
Messages posted in the Telegram channel added a curious detail: a note reading that “regarding Asos, payment information is not affected,” alongside a claim that it was a “legitimate channel” and a warning to “be wary of impersonation and deception.” Cyber security firm Sophos told Sky News it had never heard of the group before.
What is verified and what is not
Here is the state of play as of the afternoon of October 6:
- Verified: Thousands of customers received the rogue notification. Downdetector, which tracks app and website issues, logged more than 400 reports from concerned customers. ASOS’s own chatbot was telling customers the company is “currently investigating the issue.”
- Verified: ASOS shares fell sharply. Reuters reported a drop of more than 11%, while The Times reported the FTSE 250-listed company’s stock fell by as much as 14% to 432p before recovering slightly. The Register reported a fall of around 12%.
- Unverified: Whether anyone actually accessed ASOS’s data. As The Register noted, the rogue notification on its own does not prove the sender accessed the company’s Snowflake instance or any sensitive customer data. ASOS had not confirmed the cause of the alert and Reuters said it could not independently verify the reports.
- Unverified: How the message was sent. It is still unclear whether the attackers compromised ASOS’s notification infrastructure or found another route to push the message out to customers.
Why a push notification is such a strange attack vector
Security experts have called the tactic unusually brazen. Hackers typically stay quiet about a breach until they can extract maximum leverage; blasting a threat to every customer’s phone screen is the opposite of subtle. Marijus Briedis, chief technology officer at NordVPN, said the message was an “unusually brazen and threatening” one, noting that the attackers were not simply claiming a breach but publicly demanding the company engage with them.
There are a few possible explanations. The attackers may genuinely have access to ASOS’s notification service, which would itself be a significant compromise. Alternatively, they could be running a bluff, sending the message through a compromised or abused third-party channel and hoping the panic forces a payout. The Telegram channel’s claim that payment data is unaffected could be an attempt to look legitimate and keep negotiations alive. Until ASOS confirms what happened, both scenarios remain on the table.
Either way, the incident highlights a risk that does not get much attention: the notification systems of consumer apps can be turned into a weapon. A trusted brand pushing a message to millions of phones is an ideal platform for extortion, phishing, and panic, which is why shoppers should always verify alarming messages through official channels rather than clicking links inside them.
ASOS becomes the latest UK retail cyber target
If a breach is confirmed, ASOS would join a growing list of British companies hit by cyberattacks. Marks & Spencer and the Co-op were both hit by damaging hacks in the spring of 2025 that led to empty shelves and wiped out millions in sales and profit, while a cyberattack on carmaker Jaguar Land Rover in August 2025 was estimated to have cost the company, its suppliers, and local businesses around 2 billion pounds.
ASOS, which also owns Topshop and Miss Selfridge, has around 17 million customers globally, and the UK is its largest market, representing 49% of revenues in the first half of its latest financial year. The company is already in the middle of a major turnaround program aimed at halting declining sales and returning to profit, so the timing of the incident is particularly awkward. Retail and e-commerce platforms have become prime ransomware and extortion targets — see how a single unpatched SharePoint server recently led to a nine-day network takeover at one organization.
The mention of Snowflake will also raise eyebrows among security teams. Customers of the cloud data platform were targeted in a major data theft campaign in 2024 that included Ticketmaster, AT&T, and Santander. A hacker later pleaded guilty to computer fraud charges over a spree that compromised more than 165 organizations. Snowflake has since introduced controls allowing administrators to require multi-factor authentication. The episode is a reminder of how fast unpatched or weakly secured infrastructure becomes an extortion opportunity, much like the recent Citrix NetScaler zero-day that forced emergency patching across enterprise networks.
What ASOS shoppers should do right now
Even with the breach unconfirmed, a sensible response costs nothing. Shoppers should:
- Change their ASOS password to something unique, and do the same on any other account where they reused it.
- Turn on two-factor authentication if the app offers it, so a stolen password alone is not enough to take over the account.
- Watch for phishing. High-profile incidents create ideal conditions for scam emails and texts pretending to be from ASOS. Never click links in unsolicited messages; go directly to the app or type the address yourself.
- Review account activity for unrecognized orders or changed delivery addresses, and check bank statements for unfamiliar charges.
- Ignore the Telegram channel. Do not join it or engage with it; it is unverified and could itself be a vehicle for scams.
UK law requires companies to notify users if they have been subjected to a “high risk” attack, so if ASOS confirms customer data was exposed, affected shoppers should expect official communication through verified channels.
FAQs
Was ASOS actually hacked?
As of October 6, 2026, it is not confirmed. Thousands of customers received a rogue push notification claiming the retailer’s Snowflake data instance was compromised, but ASOS has said it is investigating and has not confirmed any breach. The claim remains unverified.
Was customer payment data stolen?
There is no verified evidence of data theft at all. The Telegram channel linked in the rogue notification claimed payment information was not affected, but the channel itself is unverified and its statements should not be trusted. ASOS has not confirmed any data was accessed.
What did the ASOS hack notification say?
The push notification was titled “Asos hacked” and read: “Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.” It linked to a Telegram channel called the Xuanye Gateway.
Did ASOS shares fall because of the hack reports?
Yes. ASOS shares dropped more than 11% on Tuesday, October 6, following media reports of the rogue notifications, with The Times reporting a fall of as much as 14% to 432p at its worst point. The price recovered slightly afterward.
What should I do if I got the notification?
Do not click any links in it or join the linked Telegram channel. Change your ASOS password to a unique one, enable two-factor authentication, watch for phishing messages, and monitor your bank statements. If ASOS confirms a breach, it is legally required to notify affected users.