SIFTR Insights

ASOS security alert: what customers need to know

Updated: 6 October 2026. The investigation is ongoing.

Imagine checking your phone and seeing a notification from ASOS. You’re expecting a discount, perhaps an update on something you’ve ordered.

Instead, it says: “ASOS HACKED.”

That’s what customers saw on 6 October. The message claimed attackers had accessed the retailer’s Snowflake account and threatened to leak information unless the company engaged with them. It also directed readers to a Telegram channel.

Coming through the ASOS app itself, it was understandably unsettling. For anyone who shops there, the immediate question is simple: what does this mean for my information?

What ASOS has confirmed

ASOS says an unauthorised notification was sent at around 10am. It is investigating activity involving third-party platforms it uses to communicate with customers, and has restricted access to those notification platforms.

Names and contact details may have been accessed, but ASOS does not currently believe account passwords or payment-card information were affected.

Its website and app remain operational. The company says it is working with specialist advisers and relevant authorities. This is its current assessment, rather than a final account of what happened.

What does Snowflake have to do with shopping?

Snowflake is a cloud data platform businesses use to store and analyse information. It’s part of the technology behind a business, rather than something shoppers interact with directly.

The notification named Snowflake, but ASOS’s announcement does not confirm that specific claim. The message alone does not establish that Snowflake’s wider service has been breached.

What makes this story stand out is where the threat appeared. We’re used to being told to watch out for suspicious emails from unfamiliar senders. Here, it arrived through a familiar shopping app—the same place customers expect legitimate offers and order updates.

Why contact details still matter

Even without a password or card number, personal information can make a scam more convincing.

A message that uses your name and claims there’s a problem with your account might feel credible, particularly when you’ve already heard about a security incident. The National Cyber Security Centre warns that criminals can use exposed information—or simply news of a breach—to make fraudulent messages seem genuine.

A text offering a refund, an email asking you to “secure your account”, or a request to confirm payment for a delayed order are examples worth watching for. These are possible scams, rather than confirmed follow-up activity in this incident.

What should you do now?

• Avoid the Telegram link in the notification.
• Go directly to ASOS to check an order, your account or official updates, rather than following links in unexpected messages.
• Be cautious with requests for passwords, payments or personal details, even if the message knows your name.
• Report suspicious messages. In the UK, forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726.

There are still unanswered questions about what was accessed and how. Customers need clear updates about what information was involved, what ASOS has done and whether they need to take further action.

For now, if a message asks you to act urgently, take a moment to check it independently. Familiar branding and a convincing story are reasons to pay attention not proof that a request is genuine.