Asos App Users Hit by Ransom-Style Push Notifications Claiming Major Data Breach

Shoppers across the United Kingdom have been left alarmed after receiving unexpected push notifications from the Asos mobile app that appear to have been sent by cyber criminals attempting to extort the online fashion and beauty retailer. Dozens of customers contacted the BBC to report the strange messages, which appeared directly on their phone screens rather than through any external channel.

The notification, written in the tone of a ransom demand, is addressed not to shoppers but to the company's data protection officer and IT department. According to the message, the attackers claim to have "fully compromised the Snowflake instance" and warn that unless the company engages with them, the stolen data will be leaked publicly. The wording suggests the criminals are seeking direct negotiations with Asos rather than quietly approaching the firm through private channels.

Asos did not respond immediately to requests for comment from the BBC, leaving customers and security researchers uncertain about the scale and nature of any potential breach. The company has so far issued no public statement clarifying whether its systems have been accessed or whether customer data is at risk.

The reference to Snowflake is significant. Snowflake is a major cloud-based data storage and analytics provider used by a large number of companies worldwide to collect, analyse and retain information. It is not known whether Asos is a Snowflake customer, nor what data, if any, the retailer stores through the service. Snowflake has nevertheless been connected to several high-profile security incidents in recent years, including breaches involving Ticketmaster and Santander, which has made its name familiar to many in the cybersecurity industry.

What makes this incident particularly striking is the method of communication. Rather than contacting the company privately and attempting to negotiate a discreet payment, the perpetrators appear to have used Asos's own notification system to broadcast their demands to a wide audience of customers. Charlotte Wilson, head of enterprise at the cybersecurity firm Check Point, described the tactic as deeply serious and unusually brazen, noting that the hackers had effectively turned Asos's own app into their ransom note. She pointed out that millions of people place their trust in app notifications precisely because they are supposed to originate directly from the company itself.

On social media, numerous users have shared screenshots and posts expressing confusion about the message and concern about what it might mean for their personal information. The message includes a link directing recipients to a Telegram channel operated by the purported attackers. The group, which calls itself Xuanye Group, is unknown and appears to have created its Telegram channel only recently. It has published just three posts so far, with the most recent one concerning the claimed Asos hack.

Security experts suggest the incident may point to a broader compromise than the attackers' initial claim implies. Dan Bird, from the cybersecurity firm Horizon3, explained that delivering a push notification to Asos app users would require access to the company's notification infrastructure, which operates separately from the Snowflake data platform the attackers say they breached. If both claims prove accurate, he said, it would indicate the attackers obtained credentials granting them entry to more than one system.

The public nature of the apparent extortion attempt sets it apart from typical cyber-crime operations. Most ransomware and extortion campaigns are conducted behind closed doors, with criminals deliberately avoiding publicity in the hope of securing a quiet payout. Broadcasting demands to customers risks alerting authorities, regulators and the media, and could complicate any future negotiations. The decision to go public may indicate that the attackers are confident in their leverage, or that they are pursuing a strategy designed to maximise pressure on the company through reputational damage.

For Asos customers, the immediate concern is whether any personal information has been exposed. The notification does not specify what data the attackers claim to hold, and the company has not confirmed whether a breach has occurred at all. Until Asos provides clarity, users are being advised to remain cautious about any further suspicious messages and to monitor their accounts for unusual activity.

The incident also raises broader questions about the security of third-party data platforms and the interconnected systems that retailers rely on. Companies frequently store vast quantities of customer information across multiple cloud services and internal tools, and a single set of compromised credentials can sometimes provide access to several of these environments simultaneously. Experts have long warned that the growing complexity of corporate IT infrastructure increases the potential for attackers to move laterally between systems once they gain an initial foothold.

Asos now faces pressure to explain quickly what has happened and to reassure its customer base. The retailer's response in the coming hours and days is likely to shape how the public perceives its handling of the situation, particularly given that the warning reached users through a channel many associate with trusted, official communication from the brand. Whether the claims ultimately prove credible or overstated, the episode has already demonstrated how easily a company's own tools can be turned against it.