Fashion retailer Asos has confirmed that shoppers' personal data was exposed in a cyberattack after thousands of customers received a 'threatening' app notification claiming the company had been hacked.
The incident began on the morning of Tuesday 6 October 2026, when customers were sent an unauthorised notification asserting that Asos's Snowflake cloud data instance had been compromised and demanding a ransom. The message alarmed shoppers and sparked a flurry of speculation on social media.
After a 48-hour investigation, Asos told customers that an 'unauthorised party gained access to an ASOS employee account', achieved by 'impersonating a trusted contact to obtain log in credentials'. Using the stolen credentials, the attackers were able to access information held on 'certain third-party platforms' used by the brand. Those platforms were then 'immediately locked down' to prevent further access.
The company confirmed that some personal information, including names and contact details, and other 'non-personal account related information' had been obtained. The investigation found that no payment card information or account passwords were accessed.
Asos apologised for the 'unauthorised notification' and for any 'uncertainty caused', insisting its website and app 'were safe to use throughout, and remain safe to use today'. It said it was working with relevant law enforcement and regulatory authorities and would contact those affected directly once its investigation was complete. The retailer also disclosed the breach to shareholders via the London Stock Exchange.
The attack bears the hallmarks of a social-engineering intrusion, in which criminals impersonate trusted colleagues to steal login credentials, rather than a direct technical compromise of Asos's own systems. Cybersecurity experts have warned that employee impersonation attacks are becoming one of the most effective entry points for hackers targeting large retailers.
The breach adds to a bruising period for the online fashion brand, which has faced intense competition and squeezed margins in recent years. How the company handles customer communications in the coming weeks, and whether regulators take action over the compromised data, will determine whether this becomes a lasting reputational blow.
The incident is among the most disruptive cyberattacks to hit a UK retailer this year. Asos said it had locked down the affected third-party platforms within hours of discovering the intrusion and had engaged external cybersecurity specialists to support the investigation. Industry experts said the attack underscored the growing threat of social engineering, where criminals trick staff into handing over credentials rather than breaking through technical defences. The Information Commissioner's Office may examine whether Asos met its data-protection obligations. The retailer said it would notify affected customers directly once its investigation concludes, and urged shoppers to remain vigilant against phishing attempts exploiting the breach.