Asos confirmed on Tuesday that hackers sent an unauthorised notification to app users demanding ransom, marking a rare public extortion attempt in cyber-attack history.
Dozens of customers received a message headed "ASOS HACKED" addressed to the company's data protection and IT teams. The notification, which appeared around 10:00 BST on Tuesday, stated "We have fully compromised the Snowflake instance" and linked to a Telegram channel with the message "Engage with us, or we will leak it." Snowflake is a data platform Asos uses to collect, analyse and store customer information.
Asos acknowledged the incident on Tuesday afternoon, saying some "basic personal information" may have been accessed. The company apologised to customers in an email that night and urged them not to engage with the notification. It stated the website and app are "operating as usual" and customers can "shop with confidence" during the investigation.
The notification reached users across multiple countries including Australia, France, Sweden and the Republic of Ireland. The BBC understands the National Cyber Security Centre has offered assistance to Asos. The company has not yet informed the UK's Information Commissioner's Office, the data watchdog, about any breach.
Asos said it took "immediate action to restrict access to the notification platforms" on Tuesday and stated it does not believe payment card information or account passwords were impacted. Snowflake told the BBC its investigation was ongoing but had found "no compromise" of its platform so far.
Cybersecurity experts called the attack "brazen" and "deeply serious". Charlotte Wilson, head of enterprise at Check Point, said hackers had "turned Asos' own app into their ransom note." Dan Bird from Horizon3 noted that sending a push notification requires access to Asos's notification system separate from Snowflake, suggesting attackers may have obtained credentials providing broader access.
The attack is unusual because most extortion attempts happen privately rather than through public customer notifications. Asos shares fell around ten percent on Tuesday. The company serves approximately 17 million customers annually across more than 150 markets.