ASOS Customers Receive Bizarre “Hacked” Message Amid Suspected Snowflake Compromise
ASOS customers received alerts claiming hackers compromised Snowflake and will leak data.
On October 6, ASOS customers received app push notifications, addressed to the retailer's data protection officer and IT team, claiming attackers had fully compromised its Snowflake instance and would leak it unless contacted. The message was signed xuanyewengateway and linked to a Telegram channel. ASOS has not confirmed a compromise. Commentators said the notification shows access to some connected systems but not the claimed data scope, and advised customers not to open the link and to change passwords.
- October 6 push alerts claimed ASOS's Snowflake instance was fully compromised.
- The message was signed xuanyewengateway and linked to Telegram.
- ASOS has not confirmed unauthorized access or data exposure.
- Experts treat it as possible extortion and warn customers not to click.
- ASOS marketing uses Simon AI, which runs on Snowflake.
Full article694 words · extracted from infosecurity-magazine.com · click to collapse
Customers of online fashion retailer ASOS have received a strange mobile notification claiming the company has been hacked via a Snowflake compromise.
Appearing as a legitimate ASOS push notification, the message, issued on October 6, read: “Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.”
The message was signed ‘xuanyewengateway’ and provided a link to a Telegram channel.
DPO stands for data protection officer, the person appointed by an organization to oversee how personal data is collected, stored, used and protected. The General Data Protection Regulation (GDPR) requires any organization operating in the UK or the EU to have a DPO.
Snowflake is a cloud-based data platform that companies use to store, manage, analyze and share large amounts of data. Rather than keeping data on a company’s own physical servers, Snowflake provides cloud infrastructure that allows organizations to centralize data and access it from different systems and locations.
Cyber threat actors frequently attempt to gain unauthorized access to companies via Snowflake compromises.
The latest large-scale known incident affecting Snowflake occurred in May 2024, when threat actors used stolen credentials – harvested by infostealer malware – to log directly into customer Snowflake tenants that did not have multifactor authentication (MFA) enforced.
More recently, in August 2026, security researchers at Wiz, part of Google Cloud, discovered a critical script injection vulnerability in one of Snowflake’s public repositories on GitHub through the cloud service provider’s HackerOne vulnerability disclosure program.
ASOS has not confirmed any compromise at the time of publication.
Experts Warn of Potentially Extensive ASOS Data Breach
Commenting on the alleged breach of ASOS, Jake Moore, global cybersecurity advisor at ESET, warned that, if confirmed, it could be “one of the most visible hacks in history” and could “put a lot of customer data at risk.”
“The fact the hackers managed to send a push notification to customers suggests they have gained access to at least some of ASOS’s connected systems, but it doesn’t prove their full claims about the extent of the data breach,” he added.
“By broadcasting their breach directly to ASOS app users, the threat actors are likely trying to apply pressure to ASOS, showing how extensive their access is so they can leverage some sort of ransom.”
Pieter Arntz, senior malware intelligence researcher at Malwarebytes, highlighted that ASOS uses Simon AI for marketing, which runs on Snowflake, making the connection indirect.
“It’s too early to say how much ASOS customer data attackers could get their hands on, but the potential scope is significant,” he said.
“Any exposure could reveal a detailed customer picture, from browsing and buying habits to location and loyalty status. That’s valuable profiling data, though the connection alone doesn’t establish what attackers could actually access,” he added.
Additionally, Michele Campobasso, senior security researcher at Forescout, said he estimated that the message, and especially “the lack of any additional information and the (short) presentation of a group,” suggests that the threat actor is planning to claim more attacks.
ASOS app users ought not to click on the link in the notification and avoid the engaging in the Telegram account. ASOS customers should also change their passwords for an extra layer of protection.
Experts Urge Immediate Investigation and Customer Precautions
While there remain a number of facts still to be verified about the incident, Kamran Bahdur, CIO at cybersecurity resilience firm FLR Spectron, said the claims in the notification “should be taken seriously and treated as a potential extortion attempt.”
Bahdur noted that the immediate priority for ASOS will be to establish whether there has been any unauthorised access, review Snowflake audit and authentication logs, assess any data exposure and follow the incident response process.
“Any decision on engaging with the threat actor should be made with input from legal, regulatory and law enforcement partners,” he said.
He also highlighted that ASOS personnel should avoid direct engagement with the threat actor outside of an agreed response strategy vetted by legal representatives.
Infosecurity has contacted ASOS and Snowflake for comment.
Image credits: Koshiro K / chrisdorney / Shutterstock.com