ASOS confirms customer data access after rogue app alerts

ASOS says attackers hijacked app alerts and accessed customer contact data; Snowflake says its own platform was not breached.

On 6 October 2026, ASOS mobile-app users received unauthorized push notifications titled “ASOS HACKED,” addressed to the retailer’s data-protection and IT teams and claiming that a new group calling itself Xuanye Group had fully compromised an ASOS Snowflake instance and would leak data unless contacted on Telegram. Early accounts disagreed on scale—dozens versus thousands of recipients—and an ASOS representative initially told Sky News the alert was fraudulent and under investigation. ASOS later confirmed unauthorized use of third-party customer-communication platforms, said it had restricted that access and was working with specialists and authorities, and said names and contact details may have been accessed while payment-card data and passwords were not believed affected. Later reports, including an ASOS statement to the London Stock Exchange and BBC accounts citing an attacker sample, described theft of names, addresses, phone numbers, emails, dates of birth, customer numbers, and website search terms via Simon AI, a Snowflake-based tool used with Braze; Group-IB, however, said it had seen no sample proving a customer-database breach. Snowflake said its own platform was not compromised. Accounts of the entry method also differ—social engineering of an employee or impersonation of a trusted contact—while a separate July credential-stuffing incident has no confirmed link, and ASOS shares were reported down more than 11%.