- ASOS says hackers accessed outside platforms it uses to communicate with customers, potentially exposing customer names and contact details.
- The company does not believe the attack affected card data or passwords.
- The hackers’ claim about a Snowflake breach is unproven, and Snowflake says it found no compromise of its own platform.
Customers of ASOS woke up Tuesday to a strange alert on their phones. It came from the retailer’s own app. It said the company had been hacked.
ASOS later confirmed in a statement that someone broke into third-party platforms it uses to talk to shoppers. The company says basic personal details may have been exposed. It has not revealed the scope of the incident.
How the Alert Came and the Key Details
The push notification appeared through the retailer’s official mobile app with the title: “ASOS HACKED.” It was written for the company’s data protection and IT teams, not for shoppers.
The message claimed the sender had “fully compromised the Snowflake instance.” Snowflake is a cloud service that companies use to store and study large amounts of data. The message told ASOS to make contact or face a leak.
According to reports, the alert began around 5:00 a.m. Eastern time. That is about 10 a.m. in London. Readers there and on Reddit reported the same message. One report says users in the U.S., UK, Germany, and Australia received it.
The alert carried a link to a Telegram channel belonging to a cybercrime gang that calls itself the Xuanye Group. The link first led to a “gateway” channel. That page then sent visitors to a second channel the group calls its official one. Reports describe the group as new and previously unknown.
Since the alert came through ASOS’s real app, this was not a fake message from an outsider. The attackers used the company’s own tools.
ASOS Says Incident may have Compromised Personal Data
ASOS said it is investigating unauthorized activity involving third-party platforms it uses to message customers. It cut off access to the notification platforms right away. It is working with outside experts and the relevant authorities.
The company said names and contact details may have been accessed. But it does not believe the intrusion compromised payment card details or account passwords. Its website and app still work, and operations are still fully functional.
ASOS also said it carries cyber insurance, including coverage for business interruptions. It added that it is too early to measure any effect on sales. The app now shows a notice telling users to ignore the alert. It also warns them not to tap the link inside it.
The Snowflake Claim
The company has not confirmed that its Snowflake account was breached. Snowflake has pushed back too. A spokesperson told Infosecurity Magazine the company began investigating as soon as it learned of the alert. So far, it has found no compromise of its platform.
However, that does not close the question. Malwarebytes researcher Pieter Arntz noted that ASOS uses a marketing tool called Simon AI, which runs on Snowflake. In that case, any link between the two would be indirect.
Security analysts also point out a basic fact. Sending a push alert takes access to the notification system. It does not require access to the main data store. One analysis said the attackers likely needed only the keys that connect a customer-data tool to the push provider.
Snowflake has a history here. In 2024, attackers used stolen logins to reach data at about 165 Snowflake customers. AT&T, Ticketmaster, and Santander were among them. Those accounts lacked a second sign-in step. Nothing so far ties the Xuanye Group to that campaign.
Details of Xuanye’s Claims
The group’s Telegram posts have shifted. At first, the admin said they didn’t access payment data. Later, a “final statement” said the group holds customer information on its own server. It said the data would stay untouched for a set period.
The group has not said what data it took or the size of the data they access. It has also not provided a sample. Without proof, the size of the theft is still unknown. The group’s words alone don’t prove anything
Experts’ Opinion of the Incident
Jake Moore, a security advisor at ESET, said the push alert shows the hackers reached at least some connected systems. It does not prove their wider claims, he added. He said the move looks like an attempt to pressure ASOS into paying.
Other experts called it a clear extortion attempt. Kamran Bahdur of FLR Spectron said ASOS should check its Snowflake logs and sign-in records. He advised that ASOS involve lawyers, police, and regulators if they’re going to engage with the hackers.
Arntz warned that the risk may be huge. Shopping data can reveal a lot about customers, their buying habits, where they live, as well as their loyalty status. That kind of profile is valuable to criminals, even without card numbers.
Michele Campobasso of Forescout said the brief message and short group intro suggest more attacks may follow.
The Incident Triggered a Sharp Market Reaction
Investors noticed shares fell sharply after customers began reporting the threatening message. Reuters reported that ASOS stock dropped around 10%, while the shares fell even further during the trading session. The company was already struggling. Its stock has lost most of its value over the past several years.
The market reaction shows how quickly a cyber incident can affect a company before investigators know its full scope. ASOS has said it has cyber insurance, including business-continuity coverage. However, it is too early for the company to estimate the financial impact of the incident.
Copycat attacks are possible. A push alert reaches every user at once and costs the attacker little. Attackers have also exploited wider supply-chain concerns to make phishing campaigns more convincing, as seen when cybercriminals exploited global supply chain fears with fake ‘Out-of-Stock’ phishing scams. Other retailers that use similar marketing tools may be watching closely.
What Customers Should Do
The UK’s National Cyber Security Centre is assisting with the incident. The NCSC said ASOS is investigating the incident and also confirmed that the attackers may have accessed names and contact details. The agency is also warning customers to watch for suspicious messages that may follow the incident.
Meanwhile, ASOS has not told customers to take any special steps beyond ignoring the alert. Still, a few simple moves make sense.
- Do not tap the link in the alert. Stay out of the Telegram channel.
- Watch for emails or texts that claim to be from ASOS. Scam messages are often the next step for criminals after a data breach.
- Never give in to anyone who contacts you asking for a password or code.
- Consider changing your ASOS password. Forescout’s Campobasso suggests it as an extra layer of safety, even though ASOS says passwords were not affected.
- If you reuse that password elsewhere, change it on those sites too.
Customers who want to confirm what happened should check the notice in the app or ASOS’s official website.
What Comes Next
Several questions remain open. ASOS has not said how the attackers got in. It has not said how many customers had data exposed. It has not said whether it will pay or talk to the group.
The company also faces regulatory duties. UK and EU privacy law requires companies to report certain breaches and notify affected people. Whether that applies here depends on what the investigation finds.
For now, there aren’t many facts to base a conclusion on. Hackers reached ASOS’s messaging tools and used them to reach customers. The rest rests on a group that has offered no proof.
