ASOS customers received an ominous push notification on Tuesday 6 October, alerting them that ASOS had been compromised. Addressed to the DPO (Data Protection Officer) and the IT department at ASOS, the message prompted them to engage in communication over their telegram channel, or face data being leaked on the internet. This cyberattack made national headlines, inciting fear into ASOS customers and led to a 9.6% drop in share price within 24 hours.
What happened?
The unidentified attackers were able to gain unauthorised access to ASOS’s third-party platforms by impersonating a trusted contact to obtain login credentials. The attackers claimed that they had fully compromised ASOS’s Snowflake instance. While this may have been the case, Snowflake has disputed the claim. A Snowflake spokesperson confirmed that there was an ongoing investigation and that “no compromise” of the platform itself had been discovered. On the surface, this makes the hackers’ claims less legitimate, however there is still the possibility that the hackers accessed ASOS-controlled data, credentials or integrated systems by not bypassing the Snowflake platform itself.
Since the attack, ASOS has made it clear that it was attacked, immediately locking down affected platforms to ensure that no further information could be accessed, along with conducting a full investigation with both internal and external experts. They released a public statement confirming that the hackers had access to some personal information and certain non-personal account-related information, further stating that no payment card information had been accessed nor any passwords. This indicates that the data breach is not as severe as initially anticipated, yet the consequences have already been felt.
Despite the rumours circling online, ASOS has not established the technical failings which led to the data breach, suggesting that findings will be published after their investigation.
Why the method matters?
Data breaches are a type of cyberattack where attackers gain unauthorised access to companies’ information. The criminals’ aim with a data breach is often to blackmail the targeted corporation by keeping a copy of the company’s sensitive information. This information is incredibly valuable to the company, as they have the legal obligation to ensure that customers’ personal information is kept safe from unauthorised access under the Data Protection Act 2018 (DPA 2018) in the UK. The stolen sensitive data can be sold in online marketplaces, maliciously used or released to the public for anyone to access. This increases the threat of ASOS customers being at risk of identity theft, potentially leading to financial loss to these customers.
While the demands from the attacker are not known publicly, the Telegraph reported that the hackers were seeking a ransom payment from ASOS, giving a two-week window to do so.
For retail businesses, customer trust is a fundamental pillar to being successful in the industry. Controlling the narrative while an attack is ongoing, allows the company to be able to minimise the trust lost by customers.
While data breaches happen, the data breach at ASOS is particularly interesting, as the attack vector is different. The communication channel allowed the attackers to control the public narrative and stay ahead of ASOS’s IT department.
Normally, companies are able to attempt to control the narrative publicly, as they are able to conduct investigations and liaise with lawyers before publishing an official statement. Here the attackers were able to alert ASOS customers of the data breach through a push notification via the official mobile app. Normally a social media post or an unrelated email address would be used to communicate with the public that a breach has occurred, therefore a direct message to the customer base is a new method.
As a result of this, the threat made by the attackers within the push notification became more legitimate, since it came through a source reasonable customers would deem trustworthy. This was all done without any public proof that any files containing customer details had been compromised, indicating that customer trust can be heavily influenced without knowing the full extent of the data breach.
Furthermore, customers could potentially be at risk of further attacks such as phishing. In this instance, attackers could send further personal unsolicited messages or calls impersonating ASOS, causing further trust issues between customers. Richard Horne, the chief executive of the National Cyber Security Centre, said it had been in contact with ASOS to offer support, urging customers to be vigilant for suspicious texts or emails.
Financial Impact
Personal details being accessed by the attackers will have financial consequences for ASOS. The attack had caused a loss in confidence between investors and customers with ASOS. At the time of the attack, customers and shareholders were confused, as they did not know to what extent the data breach had caused damage.
Data breaches for corporations can lead to financial penalties by regulatory bodies, as corporations have a duty to keep customers' personal data safe, using established cybersecurity guidelines. Corporations can be fined by the Information Commissioner’s Office (ICO), which enforces the UK GDPR and DPA 2018. These fines are imposed depending on the severity of the data breach and are assessed on a case-by-case basis, weighing factors such as company negligence and the amount of data breached. Once imposed these fines can amount to £17.5 million or 4% of annual turnover, whichever amount is greater. These sanctions can have a significant impact on the company, putting future strain on the company’s finances.
The share price of ASOS dropped 9.6% within 24 hours of the push notification to 454p, and has failed to rebound to its previous price of 502p. The share price rebounded by 2.6% shortly after the ASOS public statement, suggesting that investors and customers had regained confidence in ASOS’s security of user information, since the attack was not as severe as suspected. The fact that they highlighted that payment details had not been accessed likely played a part in confidence being regained.
Source: London Stock Exchange
The share price returned to 438p on Friday 23 October. In the meantime, there have been no further updates regarding whether ASOS was negotiating with the attackers or whether they had concluded their investigation. Despite the worrying signs, it should be noted that the share price of 438p (as of Friday 23 October) is similar to the share price prior to the pre-close trading update for the financial year released by ASOS on Thursday 24 September 2026. The share price rose significantly due to the positive outlook the trading update displayed, peaking at 515p, a 19% increase. This is important context, as it suggests that investors’ initial optimism from the trading update had faded, since the trading update did not reflect the latest circumstances within the company.
Although it is not clear whether or not ASOS will pay the ransom, it is unlikely given the circumstances. ASOS continued to function throughout the attack, while maintaining the fact that payment details and account passwords were not accessed. There would be a greater incentive for ASOS to communicate and pay the ransom to the attackers, if there were an imminent threat of payment details or full profile information being leaked on the internet. Furthermore, paying the ransom would incentivise attackers to continue attacking corporations as it would make cyberattacks more lucrative. The ransom payment could also give the attackers more resources to attack bigger systems and fund other criminal activities.
This has made repeated headlines for UK-based corporations with large corporations such as Jaguar Land Rover (JLR), Marks & Spencer and Morrisons being hit with similar cyberattacks recently.
These attacks cause significant business implications, which can last months before they are resolved. The cyberattack on JLR in 2025 was the worst cyberattack financially with an estimated £1.9 billion being lost from the UK economy. JLR announced in September 2026 that 4000 jobs had been cut as they continue to recover from the attack in September 2025 that forced production to halt for 5 weeks.
While it may be easy to pin the blame on a lack of security measures to prevent the attacks, the most vulnerable aspect of a company’s security system is often the humans within the company, especially employees with higher levels of access. Multiple preventive measures are often placed at these corporations such as password rotation, strong password thresholds, multi-factor authentication (MFA) and controlled user access levels. These security measures reduce the risk of successful cyberattacks; however they do not completely prevent them.
Conclusion
The ASOS data breach has been an unusual attack, where the attackers have been able to reach customers through a verified channel at scale. Doing this, while allegedly gaining access to sensitive customer information, makes this attack detrimental to the trust ASOS had built with its customers, since its creation in 2000.
Despite initial fears, it seems unlikely that the hackers have accessed extensive amounts of personal information, passwords or payment details, however the full extent of the data breach is still unknown. ASOS uses isolated systems to store different types of details; therefore, being able to send a push notification should not automatically give the attackers access to the full database or more sensitive information.
Something which is peculiar about this situation is the time frame in which ASOS has to communicate with the attackers before they release the stolen data. Two weeks is a very generous amount of time for the IT department to make contact with the attackers. This gives ASOS ample time to conduct internal investigations, liaise with law enforcement and the National Cyber Security Centre, before coming to a conclusion.
Highlighting the fact that the attackers have not publicly published a sample of the data they claim to have obtained, I am sceptical of the validity of their claims that they have access to customer data and are able to release it to the public, if they do not receive adequate compensation from ASOS.
Using all the public information available, I do not believe that ASOS’s long-term growth will be impacted by this attack, as they have already taken the correct measures to minimise the severity of the attack. With spending on security and staff training set to increase, I believe that ASOS will learn from this event and prioritise preventing this attack from happening again. And this attack serves as a reminder to other companies, especially UK-based ones, that employee training to prevent cyberattacks is of utmost importance.
As for whether customers should continue shopping with ASOS, I would encourage them to continue using ASOS’s services as usual, until more information about the severity of the attack is released. Follow the guidelines set by the official ASOS response and remain vigilant against phishing attempts made by attackers impersonating ASOS employees. When the full investigation has been conducted, then we will be able to make informed decisions on what to do next.