ASOS Data Breach Exposes Millions of Customer Profiles

Online fashion retailer ASOS is managing a significant data breach that began on October 6, 2026, when millions of customers received a mobile app notification titled "ASOS HACKED." The alert, linked to a Telegram channel operated by the Xuanye Group, claimed that the company's Snowflake cloud data instance had been fully compromised and demanded engagement to prevent a data leak.

While ASOS initially reported that only basic personal information like names and contact details may have been accessed, the company later admitted the breach was more extensive. Stolen data now includes addresses, phone numbers, emails, customer numbers, and specific website search terms. ASOS maintains that payment-card information and account passwords were not compromised. The company revealed the breach occurred after attackers impersonated a trusted contact to steal an employee's login credentials.

Snowflake conducted an investigation and reported it found no compromise of its own platform, though hackers claimed to have used Simon AI, a platform built on Snowflake, to access the data. In response to the incident, ASOS restricted access to the affected third-party communication platforms and is working with the National Cyber Security Centre and specialist advisers. The company's shares on the London Stock Exchange fell by more than 10% following the announcement. ASOS has warned customers to remain cautious of unsolicited messages and impersonation scams.