UK fashion giant ASOS is investigating a data breach after hackers began sending push notifications to customers claiming they had accessed their personal information.
On October 6, 2026, ASOS customers received a push notification directed to the company’s data protection officer and IT teams, containing a link that redirected victims to a newly created Telegram channel.
The notification read: “ASOS HACKED” as the title, followed by the message, “Dear Asos DPO [data protection officer] and IT, we have fully compromised the Snowflake instance.”
Third-party data breach hits ASOS
According to a statutory filing with the London Stock Exchange, the data breach affected a third-party platform the company uses to host customer data and for communication.
“We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers,” the company stated.
Upon learning of the breach, the company promptly terminated the threat actor’s access, shut down the affected third-party platform, and hired external cybersecurity experts to investigate the incident.
The probe found that the data breach exposed customers’ basic information, including names, contact details, and non-personal account information. However, it did not expose payment information such as credit card details or account details, such as passwords.
However, exposing contact information puts customers at an elevated risk of phishing attacks that could lead to the disclosure of more sensitive information, such as credit card details. Attackers could also include a link in the push notification that redirects victims to a phishing site.
Nevertheless, the company said the incident did not disrupt operations and that its website and mobile apps continued to operate normally. The company also displayed an in-app notice urging users to disregard the push notification.
“If you received an unauthorised ASOS push notification earlier today, please disregard the notification and do not click or engage with the external third-party link it contained,” it stated.
So far, ASOS has not disclosed the compromised third-party platform or the identity of the actor. However, the company disclosed that the data breach stemmed from a social engineering attack that compromised an employee’s credentials.
Meanwhile, a little-known ransomware group, identified as the Xuanye Group, has claimed responsibility for the ASOS data breach. It claims to have breached the company’s Snowflake instance.
“At present, we don’t yet know whether the claim about Snowflake is real or part of an attempt to create panic and put pressure on ASOS,” said Boris Cipot, Principal Security Engineer at Black Duck. “The fact that someone was apparently able to send a message through ASOS’s own app notification channel is certainly concerning, however, it doesn’t prove that everything the attackers are saying is true. ASOS is still investigating and has not yet confirmed whether customer data was compromised.”
The hacking group assured ASOS customers that their personal information would not be misused for a specific period, suggesting that it had given the fashion retailer a deadline to pay the ransom.
Meanwhile, British authorities, including the National Cyber Security Centre (NCSC), are assisting ASOS in responding to the data breach.
“Notification services, marketing platforms, and the keys that connect them can sit outside the tighter controls, a gap routinely targeted by attackers,” said Darren Guccione, CEO and Co-Founder at Keeper Security. “The message from the attackers claimed a compromise of a cloud data platform. If ASOS’s own app depends on a notification system that typically sits apart from where data is stored, that could indicate more than one system has been breached.”
British companies targeted by cyber attacks
ASOS joins a growing list of fashion retailers targeted by cybercriminals. In 2025, a third-party data breach hit UK fashion retailer Harrods, exposing over 430,000 customer records.
In the same year, Marks & Spencer, the country’s largest fashion retailer, suffered a data breach that halted online orders, costing the company millions of dollars per day. The attack also resulted in the arrest of four suspects, including a 20-year-old woman and three males aged between 17 and 19.
Cyber attacks have also targeted other British companies. A cyber attack on the UK retailer, the Co-op, forced the company to shut down parts of its IT systems, while a ransomware attack halted production at Jaguar Land Rover facilities.
The NCSC and other British authorities have also issued advisories about China-linked cyber espionage activities leveraging artificial intelligence and large-scale botnets, targeting various organizations to steal sensitive data.
