ASOS Customers Receive Push Notification Claiming Retailer's Snowflake Data Was Compromised
Shoppers at the online fashion retailer ASOS have been sent a push notification claiming that hackers have fully compromised its Snowflake data instance, prompting the company to investigate the apparent breach.
Customers of the online fashion retailer ASOS have been sent a push notification claiming that hackers have fully compromised a Snowflake data instance connected to the company, raising immediate questions about the security of shopper information held by one of Britain's largest e-commerce platforms.
The alert, delivered through the ASOS mobile app, told recipients that the retailer's Snowflake instance had been «fully compromised». The wording suggested an attacker had gained access to a cloud data warehouse used by the company, rather than merely defacing a public-facing page or sending a nuisance message.
Several shoppers reported receiving the notification, and the message quickly circulated on social media as recipients tried to establish whether the alert was genuine or a hoax. The phrasing of the notification, which threatened to leak customer information, gave the incident a menacing tone and prompted urgent speculation about the scale of any exposure.
ASOS has not yet issued a full public statement setting out what happened, and it is not clear whether the notification was sent by an external attacker who gained access to the company's systems, by someone with internal access, or through a third-party service connected to the retailer's app. The company is understood to be investigating the incident.
The reference to Snowflake is significant. Snowflake is a cloud-based data platform widely used by large companies to store, manage and analyse vast quantities of information. A compromise of such an environment would potentially give an attacker access to customer records, order histories and other commercially sensitive data, depending on how the system is configured and what information it holds.
For ASOS customers, the immediate concern is whether personal details such as names, addresses, email addresses, order information or payment data have been exposed. The notification itself did not specify what information the sender claimed to hold, and no verified sample of customer data has been published in connection with the alert.
The incident places ASOS among a growing list of organisations confronting the security risks that come with cloud-based data infrastructure. Retailers hold large volumes of consumer information, making them attractive targets for attackers seeking either to extort payments or to sell data on criminal markets.
Under UK data protection rules, companies that suffer a personal data breach may be required to notify the Information Commissioner's Office and, where the breach poses a high risk to individuals, to inform affected customers directly. The timing and content of any such notification from ASOS will be closely watched.
Customers who received the push notification have been advised to be cautious about any follow-up messages claiming to offer support or requesting personal information. Phishing attempts often follow high-profile security scares, with fraudsters posing as the affected company to trick users into handing over passwords or payment details.
The retailer has not confirmed whether the notification was sent to all app users or only a subset of customers. The apparent targeting of a push notification channel also raises questions about how the message was delivered, since such alerts are normally controlled by the company operating the app.
Until ASOS provides a detailed account, the precise nature of the incident remains unclear. What is certain is that a routine shopping app became the vehicle for an alarming message about data compromise, and that customers now want to know whether their information is safe.
6
