Asos investigates app push notifications claiming data was compromised

Asos is investigating a security incident after users of its mobile app received push notifications claiming that the online fashion retailer's data had been fully compromised. The alerts, which began appearing shortly before 10am on Tuesday, sparked panic among shoppers and triggered an immediate financial response on the London Stock Exchange.

Thousands of customers received the pop-up message titled “Asos hacked” or "ASOS HACKED". The message stated: Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it, according to reporting from multiple outlets. The notification included a link directing users to a Telegram chat operated by an apparent cyber gang identifying as the Xuanye group.

Financial Impact and Market Reaction

The public nature of the notification immediately rattled investors. The value of Asos shares dived almost 10% on the London Stock Exchange, with reports ranging from a drop of nearly 10% to approximately 12.5%, equating to a loss of around £70 million in value. Downdetector recorded more than 400 customer flags regarding the issue as concerned shoppers rushed to social media, with some reporting they quickly deleted their saved payment methods.

Metric	Details
Timing of Alerts	Shortly before 10am on Tuesday
Share Price Impact	Fell by nearly 10% to 12.5% (£70 million in value)
Downdetector Activity	Over 400 customer flags by 11am
Company Scale	Approximately 17 million customers in over 150 countries; £2.5 billion revenue

Technical Analysis and Expert Warnings

Snowflake is a cloud platform utilized to store, process, and analyze massive amounts of data, including transactions and demographic information such as clothing sizes and body measurements. It also enables push notifications to client phones. Cybersecurity specialists noted that the delivery method indicates attackers managed to access more than just the data platform.

Dan Bird MBE, Field CTO EMEA at Horizon3, explained that sending a push notification to app users requires access to Asos's separate notification system, suggesting attackers obtained credentials that opened multiple doors. This mirrors patterns seen in past breaches affecting other high-profile Snowflake customers relying on stolen login details for accounts lacking multi-factor authentication, according to Mr Bird.

Industry analysts emphasized that the stunt was engineered to force the company's hand. Marie Wilcox, VP of Market Strategy at Binalyze, described the alert as psychological warfare designed to whip up panic and bypass rational incident response. Jake Moore, global cybersecurity adviser at ESET, called it one of the most visible hacks in history, noting that while the notification proves access to connected systems, it does not verify full claims about data theft.

Security researchers also identified the threat actor group. Aiden Sinnot, principal threat researcher at Sophos, stated that the Xuanye group had not been previously mentioned on hacker forums or Telegram channels, suggesting the stunt was an attempt to gain wider attention and establish credibility.

Customer Guidance and Phishing Risks

Asos has yet to release an official statement regarding the validity of the breach. However, when customers prompted the automated chatbot on the Asos website, the bot replied: Thanks for flagging this. We're aware of the notification and are currently investigating, adding that it had no further information to share yet.

Despite the alert, the Asos website and mobile app continued to operate normally on Tuesday morning. Cybersecurity experts have issued urgent warnings to the retailer's base of approximately 17 million customers spanning over 150 countries.

Marijus Briedis, chief technology officer at NordVPN, and Vonny Gamot, Head of EMEA at McAfee, warned that high-profile incidents create ideal conditions for secondary attacks. Customers are urged to avoid clicking the notification or Telegram links and to remain highly vigilant against unsolicited emails, texts, or messages claiming to offer refunds, compensation, or account security instructions.

Regulatory Context

Under UK law, British companies are required to report data breaches to official regulators within three days, and must directly notify affected individuals in the event of high-risk security compromises. As the investigation continues, further updates from Asos are expected as regulators and internal IT teams review the extent of the system access.