Skip to content
Subscribe
← All stories

Privacy · Incident Response

ASOS Investigates Data Breach After Customers Receive Hacking Alerts

Hackers pushed an "ASOS HACKED" alert to customers' phones and claim they raided its Snowflake account. Here is what is confirmed, what it could cost ASOS, and what to do.

Ross Grant1 min read

ASOS logo over the company's head office, Greater London House in Camden
Greater London House, ASOS head office. Photo: Stephen Craven, CC BY-SA 2.0. Logo: ASOS

The short version

Recently, ASOS customers received alarming messages through the company's app, suggesting that their personal information might have been hacked. ASOS is looking into this incident to determine what data may have been accessed and how to protect its customers. While the situation is serious, ASOS has stated that sensitive information like payment details is likely safe.

By the numbers

  • 16.4mactive ASOS customers. The NCSC says every one should assume they are affected.ASOS trading update, NCSC
  • 14%the most ASOS shares fell on the day of the hackThe Telegraph, The Guardian
  • £70mwiped off ASOS's stock market value within hoursThe Independent
  • 10m+downloads of the Android app the fake "ASOS HACKED" alert was pushed throughBBC, Google Play
  • 2 weeksthe deadline hackers reportedly gave ASOS to pay up or see data leakedThe Telegraph
  • £99mthe biggest UK data fine ASOS could face in theory: 4% of its £2.48bn revenue. Real fines are usually far lower.UK GDPR, ASOS accounts

ASOS is investigating a data breach after customers received notifications claiming their data had been compromised. The NCSC reported that the incident involves unauthorised access to the ASOS app. The notifications indicated that hackers had accessed personal data, although ASOS believes that payment card details and passwords remain secure.

Claimed vs confirmed

  • Unconfirmed

    Hackers "fully compromised" ASOS's Snowflake account

    This is what the push notification said. ASOS has not confirmed it, and Snowflake says it has found no compromise of its own platform. In 2024 hackers stole data from Ticketmaster, Santander and others by logging in to their Snowflake accounts with stolen passwords, so the claim got a lot of attention on Reddit and X.

  • Confirmed

    Someone got into the tools ASOS uses to message customers

    ASOS says third-party platforms it uses to communicate with customers were accessed without permission. That is how the alert reached people's phones.

  • Confirmed

    Names and contact details may have been taken

    ASOS says basic personal information, including names and contact details, may have been accessed.

  • Denied

    Card details and passwords were stolen

    ASOS says it does not believe payment card information or account passwords were affected.

  • Unconfirmed

    The stolen data is "safe on our server"

    The group calling itself Xuanye posted this on Telegram. It has given no proof of what it took, and security firm Sophos says the group had never been seen before.

The impact

Money
ASOS shares fell as much as 14% and closed down 9.56%, knocking about £70m off the company in a few hours. ASOS says it has cyber insurance, including cover for business disruption, but that it is too early to say what the hack will cost. For scale, Marks & Spencer's 2025 cyber attack cost it around £300m in lost profit, mostly because it had to stop online orders. So far ASOS's website and app are running normally. If regulators find ASOS did not protect customer data properly, the maximum fine is 4% of global revenue (about £99m). British Airways was fined £20m for its 2018 breach.
Reputation
The timing is bad. ASOS shares had more than doubled this year as a turnaround plan started working, and last month it raised its profit forecast to £150m to £180m. Analysts at AJ Bell warned the hack could undermine that turnaround and customer trust. It is also one of the most visible hacks a UK retailer has had: the message landed on customers' own phones, branded as ASOS.
Customers
If you have an ASOS account, assume your name and contact details are out there. The biggest risk now is scams: emails and texts pretending to be ASOS about refunds, orders or password resets. Do not click the link in the alert, go to the app or website directly, and use a strong, unique password or a passkey with two-step verification.

Why it matters

This incident is significant because it affects ASOS customers who may be worried about their personal information being misused. Data breaches can lead to identity theft and fraud, making it crucial for affected individuals to stay informed and take necessary precautions. ASOS has advised customers not to engage with the unauthorised notifications and to await further information from the company.

Key points

  1. Hackers used ASOS's own app to push an "ASOS HACKED" alert to customers' phones.
  2. ASOS says names and contact details may be exposed, but not cards or passwords.
  3. The hackers claim they broke into ASOS's Snowflake account. That is unconfirmed, and Snowflake says its platform was not breached.
  4. Shares fell as much as 14%, wiping about £70m off ASOS in hours.
  5. Expect scam emails and texts pretending to be ASOS. Go to the app or website directly instead of clicking links.

Sources

  1. NCSC (UK)

    Government

  2. Financial Times

    Reference

  3. The Guardian

    Reference

  4. BBC

    Reference

  5. BleepingComputer

    Reference

  6. The Telegraph

    Reference

  7. The Independent

    Reference

  8. Infosecurity Magazine

    Reference

  9. ASOS plc

    Primary source

Keep reading

The day's cyber news in 5 minutes.

Cyberend Daily is one short email with the stories that matter, written so anyone can follow.

No spam · 100% free · Unsubscribe anytime