Snowflake, the data platform named in a threatening message sent to ASOS customers, said the cybersecurity incident was not caused by a vulnerability, weakness, flaw, or misconfiguration in Snowflake’s service, platform, or internal systems. The company said its investigation found no compromise of the Snowflake platform and that its customers do not need to take remedial action in response to the incident. Snowflake encouraged customers to follow its security recommendations.

ASOS said an unauthorized party gained access to an employee’s account after impersonating a trusted contact and obtaining login credentials. The credentials were then used to access information on certain third-party platforms used by ASOS. The company said it restricted access to the affected platforms, launched an investigation with internal and external cybersecurity experts, and contacted relevant law enforcement and regulatory authorities.

The incident came to wider attention after customers received an unauthorized notification through the ASOS app. The message claimed that hackers had compromised a Snowflake instance and threatened to leak information. ASOS said some basic personal information may have been accessed, including names and contact details, but that it did not believe payment information or passwords had been compromised. The retailer said its website and app continued to operate and that it had introduced additional security measures. It planned to contact customers again after its investigation concluded.