Users of the ASOS shopping app received a push notification Tuesday from someone claiming to have compromised the online fashion retailer's Snowflake data environment and threatening to leak its contents unless the company responded, The Register reported. ASOS has not confirmed any breach, but its shares fell sharply as news of the message spread.

What Happened

The notification was written as a message to ASOS's data protection officer and IT staff rather than to shoppers. Its sender claimed to have "fully compromised" the company's Snowflake instance, according to The Register, and said the data would be published unless ASOS engaged. It directed readers to a Telegram channel that The Register identified as "Xuanye Wen Gateway."

The Register stressed that the notification on its own is not evidence that the sender reached ASOS's Snowflake account or any customer records. It is also unclear how the message came to be delivered through the app. The claim of a Snowflake compromise comes only from the message itself.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

ASOS had not commented publicly when The Register published, and Investing.com reported that by mid-morning the company had neither confirmed nor denied a compromise. The Register said it had also asked Snowflake for comment.

Market Reaction

ASOS shares fell as much as about 12% after the reports before partly recovering, The Register said. Investing.com reported the stock down 10.2% at 450.9 pence after opening at 485 pence and touching a low of 435.5 pence. Shares of Snowflake, the U.S. cloud data platform, fell about 2% in early trading, according to Investing.com.

Why It Matters

Using a company's own app to broadcast an extortion demand to customers' phones is an unusually public pressure tactic. Even if the breach claim proves false, the message reached customers through ASOS's own app, which raises questions about who was able to send notifications through it, and the episode has already cost the company market value.

Snowflake environments have been a target before. In 2024, attackers used stolen customer credentials to break into Snowflake accounts at more than 165 organizations, including Ticketmaster, Santander and AT&T, and stole large volumes of customer records. Connor Riley Moucka, a 26-year-old from Ontario, pleaded guilty to computer fraud, wire fraud and identity theft charges over that campaign, which brought in about $2.5 million in ransom payments, The Register said. Snowflake later gave administrators the ability to require multi-factor authentication. That history explains why markets took the claim seriously, Investing.com noted, though no link between Tuesday's message and the 2024 campaign has been shown.

What to Watch

Under U.K. data protection law, ASOS would have to report a confirmed personal data breach to regulators within 72 hours of becoming aware of it. The key questions are whether ASOS confirms or rules out unauthorized access to its Snowflake data, how the attackers reached the app's push system, whether any data appears on the Telegram channel and whether the Information Commissioner's Office is notified.