Nocturnal 
ASOS app users were left baffled and worried on Tuesday morning after receiving a push notification that appeared to show hackers threatening the retailer directly through its own app.
The message, titled “ASOS HACKED”, read: “Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.” It was sent to phones shortly before 10am, according to the Mirror, and was addressed to ASOS’s data protection officer and IT team, not to customers themselves.
Dozens of people told the BBC they had received the strange alert, with many taking to social media to share screenshots, unsure whether it was genuine or some kind of prank. Searches for “asos hacked” surged past 100,000 on Google Trends in the UK as people scrambled to find out what was going on.
The notification references Snowflake, a cloud data storage company used by many major firms to collect and analyse customer data. It is not currently known whether ASOS actually uses Snowflake’s services or what, if any, customer data may be at risk. The BBC reported that ASOS did not immediately respond to requests for comment.
Social media reaction ranged from confusion to panic. One shopper wrote on X: “ASOS got hacked but my order said in transit this morning sooo do I still get my jacket or no.” Another posted: “Delete ur card details from the asos app NOOOWWWWWW,” while others said they had rushed to remove their saved payment details from the app and website.
According to the Mirror, ASOS’s share price fell by as much as 11% at one point after the notification went out, and had continued to slide. ASOS has not confirmed a breach or commented on whether any customer information has actually been compromised.
Why it matters
Cyber security experts say the way this alleged attack has played out is highly unusual. Most extortion attempts by hackers happen quietly, behind the scenes, as criminals try to negotiate a payoff without alerting the public.
“If confirmed, this is a deeply serious attack because the hackers appear to have done something particularly brazen: turned ASOS’s own app into their ransom note,” Charlotte Wilson, head of enterprise at cyber security firm Check Point, told the BBC. “Millions of people trust notifications from apps on their phones because they are supposed to come directly from the company.”
Jake Moore, global cyber security adviser at ESET, told the Mirror: “This has got to be one of the most visible hacks in history. The fact the hackers managed to send a push notification to customers suggests they have gained access to at least some of ASOS’s connected systems, but it doesn’t prove their full claims about the extent of the data breach.”
Snowflake has been linked to a string of high-profile breaches in recent years, including incidents affecting Ticketmaster and Santander, though it’s worth stressing it’s unclear whether ASOS even uses the platform.
Moore urged anyone who received the notification not to click on it or follow a Telegram link reportedly included in the message, warning it could be an attempt to apply further pressure on ASOS or trick users.
What happens next
As it stands, ASOS has not confirmed whether it has been hacked or whether any customer data has actually been accessed. The situation is still developing, with the BBC describing it as a breaking story being updated with more details.
Anyone concerned about their account is advised to avoid clicking any links in the notification, check their payment details through the official ASOS app or website directly, and watch for any official statement from the company.
