Asos Data Breach Confirmed After Hackers Hijack App Push Alerts

A ransom note on millions of lock screens

On the morning of Tuesday, 6 October, Asos app users opened their phones to a push notification the retailer had not written. It was titled "ASOS HACKED," it was addressed to the company's data protection officer and IT department, and it claimed the senders had "fully compromised the Snowflake instance." It also warned: "Engage with us, or we will leak it."312 The alert arrived at about 10:00 UK time. That is 5:00 a.m. Eastern, which is when BleepingComputer readers started reporting it.312 It contained a link to a Telegram channel run by a group calling itself the "Xuanye group."34

Two days later, the picture was clearer and worse. In a London Stock Exchange filing, Asos confirmed that attackers had broken into a third-party platform holding data it uses to communicate with customers, and that names and contact information were stolen.1 According to the BBC, as summarised by TechCrunch, the stolen data includes home addresses, phone numbers and email addresses. It also includes profile notes such as customers' search queries on the website.1 The Independent says Asos's 48-hour investigation found that the intruders got in by impersonating a trusted contact to obtain an employee's login credentials.17

The main point is simple. This was not a zero-day exploit or a missed patch. It was a stolen login followed by a public extortion campaign, and the second part is what makes the case unusual.

How the story changed over 48 hours

Asos's account moved quickly from cautious to confirmed. On the first day, the company said it was investigating "unauthorised activity involving third-party platforms that we use to communicate with customers." It said it had restricted access to the notification platforms and that "basic personal information including name and contact details may have been accessed."46 It also said it did not believe payment-card data or account passwords were affected, and that its website and app were working normally.45 The BBC reported that Asos emailed customers that night to apologise and tell them they could "shop with confidence."12

By 8 October, "may have been accessed" had become confirmed theft. The list of stolen data had also grown beyond names and contact details to include addresses and browsing-related profile data.117 The Independent described Asos as warning that the hack was worse than first thought.17 One detail may matter for regulators. On day one the BBC reported that Asos had not yet notified the Information Commissioner's Office.12 Ground News's summary noted that UK law requires high-risk breaches to be reported within three days.13

The attackers' own messages also changed. On their Telegram channel, they first said payment information was not affected. They then posted a "FINAL STATEMENT" saying they held customer information that would "not be touched for a designated period."3 Tech Insider cites The Telegraph as reporting a two-week deadline, but no outlet has independently confirmed a ransom amount.9

The Snowflake question, and where the reporting diverges

Most of the disagreement in the coverage is about how the attack worked technically. Snowflake told the BBC it found "no compromise of the Snowflake platform."9 TechCrunch reported the same denial and added that it is unclear whether Asos's Snowflake instance was protected by multi-factor authentication.1 Both things can be true. Asos's own instance can be breached with a phished credential while Snowflake's platform stays intact.

The coverage is less consistent about how the push alerts were sent. The Guardian and Engadget described Snowflake as a service that also enables push notifications.415 Malwarebytes gave a more specific account. It reported that Asos's marketing team uses Simon AI, a personalisation tool built on Snowflake, together with Braze to trigger customer messages such as push notifications.11 Dan Bird of Horizon3 told the BBC that sending push notifications requires access to a notification system separate from the Snowflake data platform. If both of the attackers' claims are true, he said, they obtained credentials that "opened more than one door."12 TechCrunch says it is still unknown how the attackers reached the push system.2

On balance, the Malwarebytes and Horizon3 account is the stronger one. The Snowflake-hosted marketing data and the messaging layer appear to be linked but separate systems. That means the attackers' access was broader than one database login, and Asos's statement about "third-party platforms," in the plural, fits that reading.41112

The numbers also differ slightly. Help Net Security puts Asos's active customer base at 16.5 million, while the BBC and TechCrunch say about 17 million customers a year.5121 The Guardian reported shares down more than 14% during the day before closing 9.56% lower.4 PinkNews cited one estimate that roughly £70 million was wiped off the company's value. The alert also reached app users in Australia, France, Sweden and Ireland.12

Why the delivery method matters

The data stolen so far is serious but not unusual. What stands out is how the threat was delivered. Data extortion normally happens out of public view, and the BBC argued that this incident could become a significant moment in cyber-attack history.12 Charlotte Wilson of Check Point said the attackers had "turned Asos' own app into their ransom note."12 ESET's Jake Moore called it possibly "one of the most visible hacks in history."

The strategy is clear. Natalie Page of Talion Cyber Security said reaching customers directly is a typical way for extortion groups to use publicity to put pressure on victims.6 Experts quoted by Cybernews compared the approach to attention-seeking groups such as ShinyHunters.16 One analyst cited by Cybernews pointed out a weakness in the tactic: once everyone knows about the breach, the leverage of a quiet payment largely disappears.16 That is probably right, which suggests the publicity may have been aimed at building the group's reputation as much as getting paid by Asos.

This connects to what is known about Xuanye. Sophos told The Guardian the group had not appeared on hacker forums or Telegram channels before. Its principal threat researcher, Aiden Sinnott, said new crews often wait for a large target so they can arrive with "credibility."4 On that view, a loud, brand-damaging attack on a FTSE-listed retailer works as an advert for future victims. Defenders should watch whether the same group, or copycats, uses other companies' push channels in the same way.

The threat-intelligence lesson: third-party access is a weak point

The Snowflake name brings back memories of earlier campaigns. Tech Insider points to past waves of attacks that used stolen customer credentials rather than flaws in Snowflake's platform.9 Daily.dev notes a similar case at Betterment, where a compromised third-party marketing platform was used to send customers a fake crypto scam.8 The pattern is the same each time. Attackers skip the hardened core systems and go after marketing and messaging tools, which hold rich data and can contact customers directly.

Alan Snyder, CEO of NowSecure, said the mobile app is now a brand's main link with its customers. Compromising it gives attackers access to both the customer and the back-end data. He added that the same access could make a fake payment request look like normal customer service.5 Pieter Arntz of Malwarebytes said the Simon AI profiles linked to Asos can include browsing and purchase history, location and loyalty status. That is valuable profiling data, though he noted the connection alone does not prove what was taken.511

The practical steps for security teams are not new. Require phishing-resistant MFA on vendor and data-warehouse accounts. Narrow what each integration is allowed to do. Treat the permission to send a push notification as a privilege as sensitive as database access.

For customers, the most immediate risk is follow-up fraud. NordVPN's Marijus Briedis warned that high-profile incidents create ideal conditions for phishing, such as messages about password resets or refunds that claim to come from Asos.4 Experts quoted by The Independent made a similar point: stolen contact details and shopping habits make personalised scams more convincing.17 Malwarebytes went further and suggested holding off on Asos purchases until the situation is clear.11

What to watch

The National Cyber Security Centre has offered Asos help. Its chief executive, Richard Horne, said the incident shows cyberattacks affect individuals, not just businesses.4 Asos says it holds cyber insurance, including business-continuity cover, but that it is too early to estimate the effect on trading.4 Several questions remain open. How many customers were affected? Did the attackers bypass MFA, or was there none to bypass? Does Xuanye publish data when its deadline runs out? And will the ICO act? Even before those answers arrive, the case shows that a phished login can be enough for attackers to send a message to millions of customers through a company's own app.