ASOS app sends customers threatening push notification claiming Snowflake hack

What happened?

Online retailer ASOS sent thousands of its mobile app users a bizarre and threatening push notification on Tuesday morning, claiming that the company's data systems had been compromised by hackers.

The message, which appeared on phone screens around 10:00 BST on 6 October, carried the stark header "ASOS HACKED". It was addressed directly to the company's security teams, stating: "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it." The alert concluded with a link directing users to a channel on the messaging app Telegram.

A DPO, or data protection officer, is the executive responsible for overseeing a company's data protection strategy and ensuring compliance with privacy regulations.

Who is affected?

It is not yet clear exactly how many of ASOS's 17 million active annual customers received the notification, but reports on social media suggest it reached a substantial portion of the app's user base. Some shoppers reported feeling "scared" by the sudden, threatening tone of the message.

At the same time the notifications began appearing, users started reporting difficulties accessing ASOS's online services. Outage tracker Downdetector recorded a sharp spike of over 500 reports of technical issues starting at around 09:41 BST.

ASOS has not yet commented publicly on the incident or updated its official social media accounts. It is currently unclear whether the hackers have actually accessed sensitive customer data, or if they merely gained unauthorized access to the system that broadcasts push notifications to mobile devices.

What is Snowflake?

The notification specifically mentions a "Snowflake instance". Snowflake is a widely used cloud-based data warehouse platform that allows major corporations to store, manage, and analyse massive volumes of business and customer data.

If the hackers' claims are true, a compromise of ASOS's Snowflake instance could mean that databases containing customer information have been accessed. However, Snowflake itself has not been reported as suffering a wider system breach, and the incident appears localized to ASOS's specific cloud setup.

What happens next?

Under UK data protection laws, ASOS is legally required to report any personal data breaches to regulatory officials within three days of becoming aware of the incident. If the breach is found to pose a high risk to customers' personal information, the retailer must also notify affected users directly without undue delay.

The market reacted swiftly to the security scare. Shares in ASOS fell by around 5% in the hour following the notification broadcast. The incident comes at a challenging time for the fashion retailer, which recently reported a drop in annual revenues to £2.5 billion for 2025, down from £2.9 billion the previous year, resulting in an operating loss of £212 million.