Asos shoppers sent pop-up message apparently from hackers threatening retailer

Asos app users have seen a pop-up message that appears to have been sent by hackers – here's what customers are advised to do

"Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it," the message reads

"Snowflake" refers to a data storage company, whose popular tools have been used by dozens of firms for collecting, analysing and storing data

Dan Bird, from cyber security firm Horizon3, says the apparent hack seems to go beyond Snowflake. He says sending the message "would require access to the company's notification system, which is separate"

It is unusual for a potential data breach to be revealed quite so publicly, writes our cyber correspondent

Our reporter asked Asos' chatbot whether her account is compromised – the bot says "we're aware" and "investigating". Asos is yet to comment on the incident

Close formHave you been affected?Get in touchLive ReportingEdited by Rorey Bosotti and Imogen James

If you're just joining us, here's a recap of what we know so far about the Asos hacking threat.

Shareclose panelShare pageCopy linkAbout sharingShiona McCallumSenior technology reporter

We’re looking into how widely today’s threatening Asos app notification was circulated, with reports now emerging overseas.

Australian media say app users there received the alert, external. The Journal in Ireland has published a screenshot from an Irish customer, while French technology outlet Numerama says it received the notification itself., external

Asos is a British retailer with a substantial global footprint. The company says it serves around 17 million customers each year across more than 150 markets.

The number of people who received the alert remains unknown. We’re trying to establish its reach, how many users received it and whether any customer information was affected.

Shareclose panelShare pageCopy linkAbout sharingJoe TidyCyber correspondent

We have heard nothing from Asos so far, but expect they could put out a statement soon.

It's a bit surprising we haven't heard from them already – it would be very unusual if this was the first the company had heard about the hack.

Usually, cyber-attacks happen in private – they are extortion events between a victim organisation and a cyber crime gang. This allows them time to negotiate a price to pay.

The kind of thing we've seen today is really unusual.

It could go down in cyber-attack history as a really significant moment – it's a very aggressive move to try to extort the company so publicly.

It is possible this is more widespread than just a UK incident. I have been speaking to someone in the US just now who also got the pop-up on her phone.

In one of the few messages the hacker has posted on its Telegram page since creating it, it says payment information is not affected. Of course, we have to take everything cyber criminals say with a pinch of salt.

Shareclose panelShare pageCopy linkAbout sharing A project manager, 23, who wants to remain anonymous, says they are "feeling very confused and scared to go into the app".

“Is my data safe? Are my bank details at risk?" the person from Canterbury tells the BBC.

“I don’t know what to do so I have just left it. I won’t click the link so I’m waiting to hear from Asos about what to do.

“I don’t feel comfortable deleting the app until I know that all my details are safe.”

Shareclose panelShare pageCopy linkAbout sharing Charlotte Wilson, head of enterprise at cyber-security firm Check Point, tells the BBC there's still "an awful lot" we don't know about the apparent Asos cyber-attack – including the motivation.

The hackers claim to have gained access to data storage company Snowflake but Wilson says this hasn't yet been confirmed. She adds that experts also aren't in a position to "confirm what [the hackers] have compromised or quite what they've got".

Asked whether the breach is serious, she says "possibly", although it is also possible the hackers are just trying to create a "big public message and an embarrassment".

Her advice to Asos customers is not to be "really scared and frightened" – and to change your password, including across other sites where the password is the same as your Asos one.

She also says you should avoid clicking on the link in the hack notification, and be "super cautious" when it comes to possible scam emails and text messages.

Shareclose panelShare pageCopy linkAbout sharingShiona McCallumSenior technology reporter

Clearly, getting an alert like this will concern people but, at the moment, there is no confirmation that customer information has been stolen.

Receiving the notification doesn’t mean your phone has been hacked – the risk will depend on if any information was accessed by the hackers.

Shareclose panelShare pageCopy linkAbout sharingImogen JamesLive reporter

We're yet to hear an official response from Asos, but in the meantime I've been speaking to the retailer's online chatbot to ask whether I'm safe to use my Asos account after the pop-up message.

The bot replied: "Thanks for flagging this. We're aware of the notification and are currently investigating."

It said it had no further information to share, but would provide an update "as soon as we know more".

I was then connected to an agent, who told me they understand my concern. They added: "Please don't worry, as we're aware of this issue and it's currently being looked into."

Shareclose panelShare pageCopy linkAbout sharingJoe TidyCyber correspondent

The company has been linked to incidents targeting services including Ticketmaster and Santander.

It is, however, unusual that any potential data breach would be revealed quite so publicly – and for customers to be informed in this manner.

Most extortions and negotiations by cyber criminals are conducted in private, with hackers hoping their discretion will result in a quiet pay-off.

Dan Bird, from cyber security firm Horizon3, says the pop up message apparently sent by the criminals implies their access has gone beyond the Snowflake database.

"Sending a push notification to Asos's app users would require access to the company's notification system, which is separate from the Snowflake data platform the attackers claim to have compromised," he says.

"If both claims hold up, it suggests the attackers got hold of credentials that opened more than one door."

Shareclose panelShare pageCopy linkAbout sharing In the pop-up message, thought to have been sent by hackers, users were told the "Snowflake instance" had been "fully compromised".

Snowflake is a data storage company, whose popular tools have been used by dozens of firms for collecting, analysing and storing data.

It uses the cloud, so businesses store, manage and analyse their data in the cloud, meaning no large databases are needed on site.

This means it's easier to share data across different teams.

Its website says there are 12,062 global customers.

Shareclose panelShare pageCopy linkAbout sharing On social media, dozens of people have posted about receiving the message – confused as to what it means.

Although the apparent extortion message has been issued directly to customers, it is addressed to Asos' data protection officer (DPO) and IT team.

It also refers to the data storage company Snowflake, whose popular tools have been used by dozens of firms for collecting, analysing and storing data.

It is not known if ASOS is a customer of Snowflake or what data, if any, is stored with the service.

Someone in the BBC newsroom received the notification – here's a screenshot from their phone

Shareclose panelShare pageCopy linkAbout sharing Asos users across the UK have been sent a notification from the retailer's app, apparently from hackers.

A message that appeared on phone screens on Tuesday morning says: "Dear Asos DPO and IT, we have fully compromised the Snowflake instance.

"Engage with us, or we will leak it."