ASOS hack: when your customer messaging tools become the ransom note
On Tuesday, October 6, 2026, around 10 a.m. London time, customers of British fashion retailer ASOS received a notification from the company’s official app. The headline: “ASOS HACKED”. The message wasn’t addressed to customers but to ASOS’s data protection officer and IT team. The attackers had turned the company’s own app into a ransom note, delivered straight to its customers’ phones.
For a small business, the lesson isn’t about fashion or mobile apps. It’s about a simple question: who can message your customers in your name, and with which tools? Newsletter, text reminders, Facebook Page, Google profile, website: each of these “megaphones” can be used by an attacker.
The message, annotated
Here is the notification text as reported by the BBC and Malwarebytes, with our annotations.
ASOS APP · NOW
ASOS HACKED 1
“Dear Asos DPO and IT 2, we have fully compromised the Snowflake instance 3. Engage with us, or we will leak it.” + a link to a Telegram channel 4
- The channel is genuine. The notification really came from the ASOS app. That’s what makes it credible: no spam filter, no fake sender to spot.
- The real recipient is the company. Messaging customers is a way to apply public pressure. According to the BBC, ASOS shares fell by around 10% that Tuesday.
- A claim, not proof. Snowflake says it found “no compromise” of its platform, and ASOS doesn’t mention Snowflake in its statements.
- The link is the trap. It led to a Telegram channel created that same day, according to Group-IB. Every authority’s advice: don’t click.
What’s confirmed, and what isn’t
Group-IB stresses a point that’s useful for any business: separate what’s confirmed from what’s only the attackers’ claim. Here’s where things stood on October 8.
✓ CONFIRMED BY ASOS
- Unauthorized activity involving third-party platforms ASOS uses to communicate with customers.
- Access to those notification platforms was restricted immediately.
- Basic personal information, including names and contact details, may have been accessed.
- The website and app are operating normally.
≈ LIKELY, ACCORDING TO EXPERTS
- Access to the notification system, which is separate from a database (Horizon3, Group-IB).
- Credentials that may have “opened more than one door” (Horizon3).
- A software-as-a-service (SaaS) platform compromise, a method often used against UK retailers (Team Cymru).
✗ NOT PROVEN
- Theft of a customer database: Group-IB has seen “no sample”.
- A Snowflake compromise, which the company denies.
- The exact way in, still unknown.
ASOS says it doesn’t believe payment card data or account passwords were affected. The UK’s National Cyber Security Centre (NCSC) still advises all customers to assume they’re affected, even if they didn’t receive the notification, and to watch for scam messages that can arrive long after the incident.
The real lesson: your megaphones are worth as much as your data
Group-IB puts it well: being able to send a notification shows access to a customer-messaging channel, not possession of a customer database. But for your reputation, the difference is thin. As its researcher Anastasia Tikhonova notes, the systems retailers use to talk to their customers, often run by third parties, carry as much trust as the data platform behind them and deserve the same monitoring.
Your business may not have a mobile app. But it almost certainly has several of these tools. Take inventory.
| Megaphone | What an attacker can do | Check this week |
|---|---|---|
| Newsletter (Mailchimp, Cyberimpact, etc.) | Email your whole list, export the addresses | MFA, user list, active API keys |
| Text messages and appointment reminders | Send a malicious link “from you” | Who can create a bulk send, and who approves it |
| Facebook Page, LinkedIn, X | Post, message your followers, lock you out | Page admins, former employees, outside agency |
| Google Business Profile | Change your phone number or website | Profile owners and managers |
| Website (WordPress or other) | Display a message, redirect to a fake site | Admin accounts, MFA, plugins up to date |
| Shared mailbox (info@, invoices@) | Reply to your customers, send fake invoices | MFA, unknown automatic forwarding rules |
| CRM or sales software | Automated sends, full customer export | Connected integrations, forgotten access tokens |
The Team Cymru researcher quoted by Infosecurity Magazine lists a few possible ways in for this kind of attack, without knowing which one was used at ASOS: a help desk socially engineered into resetting a password, an API key left in a website’s exposed JavaScript, or credentials reused from infostealer logs. All three are prevented with the same habits: MFA everywhere, no secret keys in your site’s public code, and unique passwords. Our article on AiTM phishing that bypasses MFA explains why a security key or passkey beats a text-message code.
If someone messages your customers in your name: the first 60 minutes
ASOS moved quickly: access restricted, a public statement that same afternoon, an apology email to customers that evening. Here’s the small-business version of that reflex.
MINUTE 0 TO 10
Cut off access: change the affected account’s password from a clean device, sign out all sessions, revoke API keys and pause scheduled sends.
MINUTE 10 TO 20
Keep evidence: screenshots of the message, the send time, the platform’s activity log. Don’t delete anything before you’ve copied it.
MINUTE 20 TO 40
Warn your customers through a different channel than the one that was hijacked: a short, factual message telling them not to click, and reminding them you never ask for payment or passwords by message.
MINUTE 40 TO 60
Open a ticket with the platform provider, call your cyber insurer and assess whether personal information may have been accessed. In Quebec, Law 25 requires businesses to keep a register of confidentiality incidents and to notify the Commission d’accès à l’information and the people concerned if an incident presents a risk of serious injury.
Write that warning message today, and decide which channel it will go out on. On the day of the incident, you won’t have time to draft it. Is the targeted platform run by a vendor? Our scorecard for rating your vendors after a data breach helps you ask the right questions.
How NeoTech can help
For businesses in Laval, Montreal and the North Shore, we inventory your megaphones (newsletter, social media, website, email, CRM), turn on phishing-resistant MFA wherever possible and clean up access left to former employees and agencies. Our automated 24/7 monitoring with on-call technician response spots suspicious sign-ins to your Microsoft 365 accounts. See also our cybersecurity services.
Book your free cyber check
Not sure how many people can message your customers in your name? In a short meeting, we review your accounts and prioritize what to lock down first.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- BBC News — Asos confirms hackers sent ‘unauthorised’ notification to app users (October 2026)
- NCSC (UK) — Incident affecting ASOS customers (October 6, 2026)
- Malwarebytes — ASOS “hackers” send push notifications to customers (October 6, 2026)
- Infosecurity Magazine — Telegram Account Behind ASOS Rogue Notification Tied to Gaming Trading (October 7, 2026)
- Commission d’accès à l’information du Québec — Confidentiality incidents (in French)
Photo: Emmanuel Jason Eliphalet, Pexels (Pexels licence).