ASOS shares drop 10% after cyber breach exposes customer data, Snowflake denies platform flaw

Shares in ASOS (LON: ASC) slumped 10% on Tuesday after the online fashion retailer warned that an unauthorised party had accessed some customer information. The breach, which began with a targeted social engineering attack on an employee account, exposed basic personal data but not payment card numbers or passwords, the company said.

ASOS said it had conducted a detailed investigation over the past 48 hours and determined that an "unauthorised party gained access to an Asos employee account by impersonating a trusted contact to obtain log-in credentials." The attacker then used those credentials to access information on third-party platforms the retailer uses to communicate with customers.

The incident became public on Tuesday when ASOS customers received a push notification on their phones stating that the retailer had been hacked. The message read: "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it," followed by a link to a Telegram channel.

A hacking group calling itself the "Xuanye group" claimed credit for the breach. In messages on the Telegram channel, the group said that payment information "is not affected" and that the ASOS app "is safe to use." It added: "The incident involves customer information, it is safe on our server, and it will not be touched for a designated period."

ASOS confirmed that "basic personal information including name and contact details may have been accessed" but stressed that "payment-card information or account passwords" were not impacted. The retailer's website and app remained operational throughout the incident and "remain safe" to use, it said. It advised customers to be cautious of unsolicited messages claiming to be from ASOS and said it would never ask for passwords or payment details via such channels.

**Snowflake distances itself**

The attacker's notification referenced Snowflake, a US cloud-based data storage firm whose tools are used by thousands of companies. However, Snowflake said its own systems were not at fault.

A Snowflake spokeswoman said: "We are aware of Asos's notification to their customers regarding this incident. We can confirm this issue did not in any way result from a vulnerability, weakness, flaw, or misconfiguration with the Snowflake service, platform, or internal environments, and was not caused by Snowflake. No remediation is required for Snowflake customers."

Snowflake said it launched an investigation as soon as it became aware of the notification and found "no compromise of the Snowflake platform." The company noted that hackers have previously targeted organisations' Snowflake data repositories; in 2024, Google's cybersecurity unit Mandiant detailed a widespread hacking spree affecting at least 165 Snowflake customers.

**Single identity, deeper penetration**

The attack highlights how compromising a single employee identity can enable deeper penetration into a corporate network, according to cybersecurity outlet Dark Reading. ASOS's investigation confirmed that the breach began with credential theft via impersonation, a common social engineering tactic.

**Market and business context**

ASOS shares, which had gained more than 60% year-to-date before Tuesday's drop, remain well below their 2018 peak amid intense competition in fast fashion. The company has been divesting assets and last month issued an upbeat profit forecast for fiscal 2026.

ASOS said it has cyber insurance, including basic continuity insurance, but added that it was too early to quantify any potential impact on trading. The retailer is working with internal and external specialist advisers as well as all relevant authorities.