British online fashion retailer ASOS has confirmed a data breach after attackers compromised a third-party communications platform and used it to send unauthorized notifications directly to customers’ phones.
The incident became visible when UK users began receiving an unexpected notification titled “ASOS hacked.” The attackers claimed they had compromised the retailer’s Snowflake environment and threatened to leak stolen information unless ASOS contacted them. ASOS has confirmed the third-party platform breach, but not the attackers’ claim that its Snowflake instance was compromised.
Hackers Turned a Trusted Channel Against Customers
The incident is unusual because customers learned something was wrong through ASOS’s own notification infrastructure.
After compromising the external platform used for customer communications, the attackers were able to send messages that appeared through the legitimate ASOS mobile app. The company quickly restricted access to the affected notification systems and brought in internal and external specialists while notifying relevant authorities.
ASOS said the attackers may have accessed basic customer information, including names and contact details. The retailer does not currently believe payment-card information or account passwords were exposed.
Its website and mobile application remained operational, and the incident did not disrupt normal business operations.
The Snowflake Claim Remains Unconfirmed
The attackers specifically claimed to have compromised ASOS’s Snowflake instance, but the company has not confirmed that part of the intrusion.
That distinction matters. Snowflake is widely used by enterprises for data analytics and AI workloads, and compromises involving customer environments can expose considerably larger datasets than a communications platform alone.
Security researchers naturally drew comparisons with the large Snowflake-related breach campaign of 2024, when attackers associated with ShinyHunters accessed the environments of more than 160 organizations using credentials previously stolen by infostealer malware. There is currently no evidence that the ASOS incident used the same technique.
Investigators will therefore need to determine whether the attackers genuinely reached ASOS’s Snowflake environment or whether the reference was simply intended to increase pressure on the company.
A New Group Claims Responsibility
A hacking group calling itself Xuanye Group has claimed responsibility through a newly created Telegram channel.
The name could suggest a Chinese-speaking actor, but researchers caution that it may also be deliberate misdirection. There is currently insufficient public evidence to confidently attribute the attack.
The uncertainty illustrates a familiar problem with modern data-extortion incidents. Attackers often make dramatic claims immediately after gaining access, while defenders may need days or weeks of forensic work to establish what was actually compromised.
Until that investigation is complete, the attackers’ claims about Snowflake should remain exactly that: claims.
Third-Party Platforms Remain a Valuable Shortcut
The ASOS breach also demonstrates why customer-engagement platforms have become attractive targets.
Companies increasingly outsource notifications, analytics, email campaigns, customer support and other communications to specialized SaaS providers. Compromising one of those services can give an attacker access to customer information while also providing something potentially more valuable: a trusted communication channel.
In this case, the attackers did not need to compromise the ASOS mobile application itself to reach customers through it. Access to the underlying communications platform was enough.
That creates an additional layer of supply-chain risk. Organizations need to think not only about what information third-party providers can access, but also what actions those providers can perform using the company’s identity.
ASOS says its core services remain unaffected and sensitive payment credentials were not exposed. But the incident demonstrates how compromising a relatively narrow external service can still produce a highly visible breach.
For attackers, trusted communications infrastructure offers a powerful advantage:instead of impersonating a company, they can sometimes make the company’s own systems deliver the message for them.