Asos confirms breach after hackers hijack app alerts

Fashion retailer Asos has confirmed a data breach after attackers used its own app to send customers an "ASOS HACKED" push notification on October 6, 2026. In a stock exchange filing, Asos said hackers broke into a third-party platform it uses to contact customers, TechCrunch reported. Names and contact details may have been taken. The case shows how one weak outside service can hand attackers a direct line to every customer's phone.

What Asos has confirmed

Asos told investors it is "investigating unauthorised activity involving third-party platforms that we use to communicate with customers," Help Net Security reports. The unauthorized notification went out at around 10am on October 6.

The company's statement, as reported by The Register and SecurityWeek, says:

• basic personal information, including names and contact details, may have been accessed
• it does not believe payment card information or account passwords were affected
• the website and app are running normally
• access to the notification platforms has been restricted
• it is working with specialist advisers and "all relevant authorities"

"We do not believe that payment-card information or account passwords were impacted," Asos said. It also said it is too early to say what the effect on trading will be. The Register adds that Asos has cyber insurance.

Asos has not said how many customers received the alert or how many had data accessed. It has not named the third-party platform.

What the attackers claimed

The notification itself carried a threat. "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it," it read, according to The Register. DPO means data protection officer. Snowflake is a cloud data platform that many companies use to store customer data.

The alert linked to a Telegram channel run by a previously unknown group calling itself "Xuanye Group," SecurityWeek and Help Net Security report. Treat these as the attackers' words. The Register notes that the message alone does not prove they reached Snowflake or any sensitive data.

Snowflake denies a problem on its side. "At this time, we can report that we have found no compromise of the Snowflake platform," a Snowflake spokesperson told The Register. Asos itself never mentions Snowflake in the reports.

What the press has reported

Some details come from journalists, not from Asos:

• TechCrunch cites BBC reporting that the stolen data also includes home addresses, phone numbers, email addresses and notes on customer profiles, such as website search queries.
• TechCrunch cites Bleeping Computer saying the attackers got in by "impersonating a trusted contact to obtain log in credentials." Asos has not confirmed this.
• The Register says Asos shares fell around 12 percent after the reports and recovered slightly. It gives no source for the figure.

SecurityWeek says the initial access method is unknown. Daniel dos Santos of Forescout Research said the pattern could resemble the 2024 attacks on Snowflake customers, which used stolen credentials. "This recent hack may be similar, although it is not confirmed what the initial access was," he said.

Why a push notification matters

A push notification goes straight to a lock screen with the brand's name on it. Customers trust it. That is why Natalie Page of Talion Cyber Security called the message "a typical tactic of extortion groups, who often leverage media attention and publicity," SecurityWeek reports.

Pieter Arntz of Malwarebytes warned about what the data could show. "Any exposure could reveal a detailed customer picture, from browsing and buying habits to location and loyalty status," Help Net Security quotes him as saying. Alan Snyder of NowSecure said a compromised notification system "provides direct access to your customers on the front end and your data on the back end."

What this means for developers

If your app sends push messages, the sending platform is part of your attack surface.

• Protect the notification system like production. Require multi-factor authentication for every account that can send pushes, and limit who has it. Asos restricted access to its platforms after the incident.
• Add a send approval step. A message to a whole user base should need a second person, or a rate limit, before it goes out.
• Review every data platform your marketing tools can reach. Map which customer fields each outside service holds. Names and search queries in a marketing store are still personal data.
• Rotate and audit credentials. Both the Snowflake story and the 2024 attacks in The Register's background point to stolen logins. Rotate service credentials and check for impersonated support requests.
• Prepare the customer message in advance. Decide how you will tell users to ignore a rogue alert and not follow links. Asos told customers exactly that.

The next thing to watch is how many customers Asos says were affected. Until it publishes a number, the scale of the breach stays unknown.