ASOS has confirmed it is investigating unauthorised activity after customers received a threatening push notification on Tuesday morning. The message, which appeared to come from the hackers themselves, warned that a Snowflake instance had been "fully compromised" and threatened to leak data unless the company engaged.
The notification read: "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it." Thousands of customers took to social media after receiving the message, with many expressing concern and some saying they had deleted their accounts or card details.
Company statement and customer impact
In a statement released through the London Stock Exchange, ASOS said: "Asos can confirm that, at around 10am today, an unauthorised customer notification was sent to Asos customers." The company said it is investigating "unauthorised activity involving third-party platforms" used to communicate with customers and has restricted access to the notification platforms.
"Basic personal information including name and contact details may have been accessed. We do not believe that payment-card information or account passwords, were impacted," the statement added.
Warning to customers and expert advice
A warning message on the app said: "If you received an unauthorised ASOS push notification earlier today, please disregard the notification and do not click or engage with the external third-party link it contained. Our teams have taken immediate action and are investigating. Customers can continue to shop with ASOS as normal."
Advice from ASOS said: "In the meantime, we recommend not clicking any links in the notification. Other than that, there's nothing else you need to do right now." Dr. Pete Membrey, Chief Research Officer at ExpressVPN, said: "Getting a message like that from an app you trust is genuinely unsettling. Most people think of a hack as something that happens out of sight, so seeing a threat land on your own phone makes it feel much more personal. It's completely understandable that people are worried, but the most important thing right now is not to panic. At times like this, panic can make matters much worse."
Background and wider context
ASOS, which also owns brands including Topshop and Miss Selfridge, has 17 million customers globally. The UK is the group's largest market, representing 49% of all revenues in the first half of the latest financial year. Many UK retailers have been cyber attackers over the past two years, including Marks & Spencer and Harrods.
Experts advised customers to make sure they are updating their passwords to maximise safety if a similar situation were to occur in the future. The website remained up and running as normal, though some customers were reportedly put off making an order after the threatening notification.
