Asos app users get an alert claiming its Snowflake instance was compromised

Asos app users in the UK got a push notification on Tuesday morning in which the senders claimed to have fully compromised the online fashion retailer’s Snowflake instance. The message, titled “ASOS HACKED”, addressed the company’s data protection officer (DPO) and IT team.

“Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it,” the notification read.

Dozens of people told the BBC they had received it, Joe Tidy reported. Users began reporting problems with the app just before 10am UK time, TechRadar reported, citing the outage tracker Downdetector .

Asos said it was aware of the reports but did not confirm a hack or comment further, the Guardian reported . The National Cyber Security Centre, part of GCHQ, is offering Asos its help, the newspaper said. The website and app appeared to keep working on Tuesday morning, the Guardian said.

The message linked to a channel on the messaging app Telegram . The channel belongs to a new group calling itself the Xuanye Group, which set it up on Tuesday, according to the BBC. When the BBC checked, the channel had three posts, the latest about Asos.

The channel also carried a message saying that “payment information is not affected”, with no further details, the Guardian reported. Sophos told the Guardian that no one had mentioned the group before on hacker forums or other Telegram channels.

The message refers to the cloud platform Snowflake , which companies use to store and analyse data. The BBC reported that it is not known whether Asos is a Snowflake customer, or what data, if any, it keeps there. In 2024, a data theft campaign targeted Snowflake customers including Ticketmaster, Santander and AT&T, The Register noted.

“Sending a push notification to ASOS’s app users would require access to the company’s notification system, which is separate from the Snowflake data platform the attackers claim to have compromised,” Dan Bird of the cybersecurity firm Horizon3 told the BBC.

Alan Snyder, chief executive of the mobile security company NowSecure, said in comments sent to TNW that a compromised app reaches both a company’s customers and its data.

“Customers shouldn’t have to figure out whether their shopping app is speaking for the retailer or an attacker,” Snyder said.

Asos shares fell by more than 14% on the London Stock Exchange after the notification, according to the Guardian. The Financial Times put the fall at more than 10%.