ASOS data incident: customers told to assume they are affected

Some customers received a push notification headed “ASOS HACKED”. It was addressed to the retailer’s data protection and IT teams, claimed that an ASOS Snowflake environment had been compromised and threatened that information would be leaked unless the sender was contacted.

The notification included a link to a Telegram channel. ASOS later apologised to customers, told them to disregard the message and warned them not to click or engage with the external link.

ASOS says it is investigating unauthorised activity involving third-party platforms that it uses to communicate with customers. It says access to the relevant notification platforms was restricted and that it is working with internal and external specialists and the relevant authorities.

At the time of writing, ASOS has not publicly confirmed how many customers are affected, every data field involved, whether information was copied or removed, how the access was obtained or how long any unauthorised access may have lasted.

Those are not minor gaps. An initial statement made during a live cyber investigation is rarely the final account of what happened.

The National Cyber Security Centre has issued incident-specific advice. It says that if you are an ASOS customer, you should assume you are affected even if you did not receive the unauthorised notification.

That does not mean every customer’s data has definitely been accessed. It is a precautionary position intended to help customers recognise and resist follow-on scams while the scope of the incident is still being established.

That has not been established. The notification claimed that an ASOS “Snowflake instance” had been compromised. Snowflake provides cloud technology used by organisations to store, process and analyse data.

Snowflake told Reuters that it launched an investigation and had found no compromise of the Snowflake platform. Its investigation was continuing.

The responsible position is to separate three things: the unauthorised notification, which is confirmed; the possible access to names and contact details, which ASOS has acknowledged; and the attackers’ wider claims, which remain unverified.

The description “basic personal information” risks making the exposure sound harmless. A name, email address or telephone number may not allow somebody to take money directly, but it can make a fraudulent approach much more believable.

If a criminal knows that somebody is an ASOS customer, they can build a message around a real relationship. The recipient may be less likely to question an email about an ASOS order, payment or refund when a genuine incident has just been widely reported.

The dangerous part is context. A scam that arrives shortly after a real ASOS incident may appear credible before the customer has had time to question it.

ASOS says it does not believe payment-card information was affected. On the information currently available, customers should not assume that a saved card has been exposed or cancel it solely because of this incident.

It is sensible to check bank and card statements. If an unfamiliar transaction appears, contact the bank or card provider using the number printed on the card, the official banking app or another independently verified route.

UK data protection law does not require every security incident to be announced individually to every customer. The organisation must assess the risk created by the breach, document its decision and apply the statutory reporting and communication thresholds.

The assessment depends on the nature and volume of the data, how easily people can be identified, the safeguards applied and the realistic ways the information might be misused. The word “basic” does not decide that assessment.

A possible data breach does not create an automatic payment. A compensation claim would depend on the established facts, whether ASOS failed to comply with its legal duties and whether the individual suffered provable material loss or non-material damage, such as genuine distress.

At this early stage, the cause, scope and consequences remain under investigation. Customers should be cautious about claims firms presenting a speculative payout as guaranteed before those facts are known.

There is no reason to panic, cancel cards indiscriminately or accept every dramatic claim made by the people behind the notification.

There is equally no reason to dismiss names and contact details as “only basic data”. The most immediate risk is not necessarily somebody entering an ASOS account. It is somebody using the ASOS name, the publicity surrounding the incident and a customer’s real contact details to make the next scam unusually convincing.

For now, customers should avoid the link, use ASOS only through its official app or website, review their accounts and wait for confirmed information about the scale and cause of the incident.