Asos Shoppers Got a Scary Phone Alert. Here's What Happened
What shoppers saw
Asos shoppers got a pop-up alert on their phones on Tuesday, 6 October 2026, saying Asos cloud services had been hacked. Engadget
The note was not meant for shoppers. It was addressed to the company's privacy officer and tech staff. Engadget It said Asos's Snowflake storage, an online system for holding large amounts of customer information, had been fully broken into. It threatened a leak unless Asos replied, and shared a link to a Telegram channel claiming to be run by Xuanye Group.
The alert came through the Asos app itself. Users across the UK saw pop-ups that looked like they came from hackers. BBC Asos app users got the threatening notification on Tuesday. The Independent
What Asos said
Asos said it is checking unauthorised activity tied to outside tools it uses to message customers. It said it quickly cut access to those messaging tools. It is also checking unauthorised access to its app system tied to the alerts. The Guardian Its app and website kept working as normal.
Asos said customers' names and contact details may have been seen in the hack. It said it does not think payment details or passwords were taken.
ASOS stock fell 13% after the hacker alert went out through its mobile app. QZ
Why it matters
The broader context here is simple. The tool that sends phone alerts sits apart from the main shop, but phones trust it as Asos. An outside sender allowed to reach every app can speak as the brand, skip spam filters and force a fast emergency.
In my view, two possible break-ins should be kept apart until records show more. One is established by delivery alone, misuse of the customer messaging tool. The other is still only an attacker claim, full break-in to the Snowflake storage. The first gives the attacker pressure. The second still needs proof from access records, checks on what logins allowed, and signs of data leaving the system.
Worth flagging for anyone using similar tools, even limited data counts. Names plus contact details are enough for fake follow-up messages and tricks to steal a phone number, especially when the first lure looks real because it came as a push alert. The apps stayed online. That distinction matters. Staying online does not settle whether someone earlier read customer lists or copies held by the messaging tool.
If there is a constructive outcome, it is stronger walls between tools that can message customers and tools that store customer data. Limited software passwords, short-term access passes, approval lists for messaging computers and separate records for data searches are now basic controls, not extras.
