ASOS

On 6 October 2026 millions of ASOS customers received an unauthorized push notification through the retailer's mobile app. The attackers had compromised a single employee account through social engineering and credential theft, then reached customer data held in the company's Snowflake environment.

ASOS confirmed the breach on 8 October and attributed it to the compromised employee account. Snowflake stated publicly that the incident was not caused by a vulnerability or flaw in its platform, which is consistent with a stolen credential rather than a platform failure.

Names and contact information, according to the company's confirmation. ASOS has not published a figure for how many customers were affected.

The absence of payment data is worth stating. What makes this entry unusual is not the fields, it is that the attackers also reached the push notification system, which is a communications channel rather than a data store. Holding customer records is one kind of access. Being able to speak to every customer on the company's behalf is another.

ASOS customers, who found out by having their phone buzz with a message from a brand they trust telling them it had been hacked. For most of them that notification was the entire disclosure process.

A retailer's push channel is a trust asset built over years of order updates and delivery alerts. Using it to announce the breach inverts that: the most reliable notification path the company owns was turned into the attacker's megaphone, and every future legitimate message now arrives with slightly less authority.

Centralising customer analytics in Snowflake is a mainstream architecture and the platform held up. Snowflake's statement that no platform vulnerability was involved appears to be accurate, and the compromise was of an ASOS employee credential.

The assumption under pressure is that one employee account is a bounded risk. In an analytics warehouse, an account exists precisely to query across the whole customer dataset, so the permission that makes the job possible is the permission that makes the breach large.

What one employee account could reach, and that the same compromise chain extended into the push notification system. Those are usually treated as separate domains with separate owners.

Analytics warehouses accumulate the widest customer dataset in the business, assembled from every system, specifically so people can ask broad questions. The access model follows the analytical need rather than the sensitivity of the assembled result, and almost nobody re-evaluates it after the warehouse fills.

ASOS has not published a customer figure, which is the familiar shape: the intrusion is established before the inventory is. The notification went out to millions. The scope statement has not followed at the same speed.

No group has been publicly named in the reporting cited here, and ASOS has described social engineering and credential theft rather than attributing to a known actor.

The push notification stunt is the attribution signal worth noting. An actor seeking quiet resale does not announce itself to millions of phones. This was done for attention, which usually means the data is secondary to the spectacle, or that publication is the leverage.

Multi-factor authentication on the account that was taken, and separation between analytics access and the customer communications channel. One credential should not have opened both.

Second, scoping what the warehouse account could query. A warehouse holds the broadest assembled view of customers in the organisation, and the question of which rows and fields any single analyst account can return is answerable at any time. It is almost never asked until a stolen credential answers it.