ASOS Customers Targeted Following Alleged Data Breach

Online fashion retailer ASOS is investigating a cybersecurity incident after customers received an unauthorised notification claiming that the company’s data had been compromised.

On October 6, customers reported receiving a message stating that ASOS had been “hacked” and that attackers had gained access to its Snowflake data environment. The notification also threatened to release stolen information. However, the message itself does not confirm that the attackers actually accessed or extracted data from Snowflake.

ASOS has confirmed that an unauthorised customer notification was sent through systems operated by third-party platforms. The company said basic personal information, including names and contact details, may have been accessed, but there is currently no indication that payment-card information or account passwords were affected. ASOS said it immediately restricted access to the affected notification platforms and launched an investigation with specialist advisers and relevant authorities.

The incident highlights a growing concern for businesses: third-party technology can become an entry point into a company’s digital operations. Companies increasingly rely on cloud providers, communication platforms and external software to store information and interact with customers. A weakness in one of those systems can therefore create consequences far beyond the technology provider itself.

For businesses operating online, the ASOS incident is another reminder that cybersecurity cannot stop at the boundaries of a company’s own network. Vendor access, cloud credentials, authentication and data-sharing arrangements all need careful oversight.

The investigation is ongoing, and the full scope of any potential compromise remains unclear. For now, ASOS customers have been advised to exercise caution with unexpected messages and avoid clicking suspicious links while investigators establish what happened.