ASOS Confirms Data Breach Following App Notification to Customers

ASOS, a prominent UK fashion retailer, has confirmed a data breach after a notification indicating that hackers had infiltrated its data was sent to customers via its app. The notification was dispatched around 10 a.m. on October 6, 2026, prompting immediate concern among users.

In a statement to investors, ASOS acknowledged the unauthorized notification and stated that it is currently investigating the incident. The company has restricted access to the platforms used for customer communication and is collaborating with both internal and external specialists, as well as relevant authorities, to address the situation.

ASOS has warned that basic personal information, such as names and contact details, may have been compromised. However, the company reassured customers that payment card information and account passwords were not believed to be affected. The exact number of customers who received the notification or how many may have had their information accessed has not been disclosed.

The notification included a message from the attackers, who claimed to have fully compromised ASOS's Snowflake instance and threatened to leak data unless the company engaged with them. This message was directed to ASOS's data protection officer and IT team, and a screenshot of the notification was shared by a user on Reddit.

Xuanye Group's Claims and Reassurances

The group behind the attack, identified as Xuanye Group, stated in their Telegram channel that customer payment information was not impacted and that the ASOS app remains safe to use. They claimed that customer information is stored on their server and would remain untouched for a specified period.

Snowflake, the cloud platform used by ASOS for data collection and analysis, is conducting its own investigation and has reported no compromise of its services thus far. Experts have noted that the potential scope of the breach could be significant, as ASOS utilizes Simon AI for marketing, which operates on Snowflake. This connection raises concerns about the extent of customer data that could be exposed, including browsing habits and loyalty status.

Cleared to File

The incident highlights the critical importance of mobile app security, particularly as these applications serve as primary interfaces for customer interactions and transactions. Security experts emphasize the need for retailers to understand who has access to their communication platforms and how quickly they can revoke that access if necessary.

This breach follows a series of cyberattacks on UK retailers in 2025, including notable incidents involving Marks & Spencer, the Co-op, and Harrods. As the investigation continues, ASOS is working diligently to mitigate any potential fallout from this breach and to protect its customers' data.