ASOS CUSTOMERS SENT NOTIFICATION CLAIMING HACK OF SNOWFLAKE DATA

Thousands of ASOS customers received a push notification on Tuesday morning claiming that the online fashion retailer had been hacked. The message, titled "ASOS Hacked" in the company's app, was addressed to ASOS's data protection officer and IT team but was sent directly to customers. It read: "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance," and threatened a data leak if the company did not engage. The notification included a link to a Telegram channel apparently linked to a group called Xuanye, which has not previously been connected to any other cyberattacks. Reports of the alert coincided with a spike on the outage-tracking site Downdetector. ASOS had not issued a public statement on the claims at the time of reporting.

ASOS describes itself as having more than 17 million active customers across 150 countries, with 34 per cent based in the EU. Irish customers also received the notification, according to reports. Snowflake is a cloud data platform used by thousands of major organisations, including Disney, OpenAI, Canva and Novo Nordisk, to store and process data, and ASOS's marketing teams reportedly use an agentic AI platform called Simon that is built on Snowflake products. Snowflake was previously targeted in 2024, according to a report from Google's threat intelligence unit. Security specialists said it remained too early to confirm whether customer data had actually been accessed.

Gavin Millard, vice-president of product at the cybersecurity firm Tenable, said that if customer information had been exposed, criminals could use it to create convincing scams for months. He said a fake delivery charge or refund message could appear credible if it included personal details, and that visiting a fraudulent payment page could expose card details. Millard said customers should be wary of unexpected messages requesting payment or personal information and should verify any request through the retailer's official website or app. He said businesses needed to establish what had been accessed and communicate clearly so customers knew what to watch for.