Asos apologises to customers after hacker stole personal data by impersonating a trusted employee contact

From the Newshound archive · first published 9 October 2026.

Online fashion retailer Asos announced on Friday evening that a malicious actor had tricked one of its staff members into handing over login credentials by posing as a familiar contact, then used those credentials to gain access to third-party platforms storing customer data — among it names and contact details. The company has launched a full investigation with the help of external cyber specialists and is working alongside law enforcement and regulators. Payment card information and account passwords were not compromised, and both the website and app remain safe to use.

Snowflake, the US cloud storage firm cited by the hackers in their threatening message, denied any responsibility, saying the breach did not stem from a vulnerability in its own platform.

Customers were sent an alarming in-app message from the hackers reading 'We have fully compromised the Snowflake instance — engage with us, or we will leak it', followed by a Telegram link.

Asos is urging customers to treat any unsolicited messages or calls claiming to be from the retailer with caution.