On 6 October 2026, from about 5am US Eastern time, users of the ASOS shopping app, mainly in the UK, received a push notification addressed to the British online fashion retailer's data protection officer and IT team: "we have fully compromised the Snowflake instance. Engage with us, or we will leak it", with a link to a Telegram channel run by a group calling itself Xuanye, which has no known track record.

Later the same day ASOS confirmed a data breach: it says third-party platforms it uses to communicate with customers were accessed without authorisation and that basic personal information, including names and contact details, may have been exposed.

ASOS says it does not believe payment card details or account passwords were affected, and it is showing an in-app notice telling customers to ignore the alert and not to open its link.

ASOS has not confirmed the claim that its Snowflake environment was compromised and has not said how many customers are affected.

Researchers quoted by the BBC said sending the notification needed access to ASOS's own messaging systems.

Sources: BleepingComputer (ASOS confirmation), BBC News.

UPDATE (8 Oct 2026): ASOS now says the breach began with social engineering. In a security notification shared with BleepingComputer it says an unauthorised party got into an ASOS employee account by impersonating a trusted contact to obtain login credentials, then used those credentials to reach information on certain third-party platforms ASOS uses. ASOS locked down the affected platforms, is investigating with external experts, law enforcement and regulators, and repeats that payment card details and account passwords were not accessed and customers need take no action beyond watching for unexpected messages or calls claiming to be from ASOS.

It still has not addressed the Snowflake claim or given a customer count.

Source: ASOS customer update (linked) and BleepingComputer (8 Oct).

UPDATE (8 Oct, BBC News): BBC News reported that ASOS later told customers hackers hold detailed customer profiles of potentially millions of users, beyond the "basic contact details" in the first LSE and customer notices.

Fields now confirmed or shown in samples include names, addresses, phone numbers, emails, customer numbers, dates of birth and on-site search terms.

ASOS said no bank details or passwords were accessed, urged caution about unexpected messages or calls claiming to be from ASOS, and said it will contact customers directly where more support is needed.

BBC News notes Snowflake has previously said its own platform was not breached. Primary confirmation of the wider profile set is ASOS's customer email as reported by the BBC (article held so ASOS could notify customers first). Wire: BBC News (Joe Tidy, 8 Oct). CORRECTION (21 Oct 2026): removed an unsourced line about the ASOS share price, removed The Register from the sources (not linked), and corrected the date of the BBC report from 13 to 8 October.

Correction (23 Oct 2026): removed the extortion group's own statements about what it holds and how it got in; Australian impact is now attributed to Cyber Daily's 8 October report. (source: https://www.bbc.com/news/articles/c3zxjdw5ywgpo)