Asos Customers Hit by Hackers' Push Notification Extortion Attempt

Users of the Asos shopping app across the United Kingdom have reported receiving unsolicited pop-up messages on their phones that appear to have been sent by cyber criminals attempting to extort the online fashion and beauty retailer, according to reports gathered by the BBC.

Dozens of individuals contacted the broadcaster after a puzzling notification appeared on their device screens, seemingly originating from Asos's own application. The message was not a typical promotional alert or order update, but a terse demand directed at the company's technical staff.

The notification read: "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it." The message also included a link pointing recipients toward a Telegram channel operated by the purported attackers.

The company did not provide an immediate response to the BBC's requests for comment, leaving customers and security researchers alike uncertain about the scope and authenticity of the claimed intrusion. The lack of official confirmation has done little to quiet speculation about how the messages were delivered and what data, if anything, may have been exposed.

Charlotte Wilson, head of enterprise at cyber-security firm Check Point, described the incident as deeply alarming if verified. She noted that the attackers appeared to have done something unusually bold by turning Asos's own app into a vehicle for their ransom demand. Wilson added that millions of people place trust in app notifications precisely because they are expected to come straight from the company operating the service.

The message appears to be addressed not to shoppers but to Asos's data protection officer and IT department, which suggests the hackers intended the notification to function as a direct warning to the company rather than a general announcement to the public. The fact that ordinary customers became the recipients of that warning has only added to the confusion.

The reference to a "Snowflake instance" points to Snowflake, a data storage company whose tools are widely used by businesses for collecting, analysing and retaining large volumes of information. It remains unknown whether Asos is actually a customer of Snowflake or what data, if any, the retailer might store through the service.

Snowflake has drawn attention in recent years because of several high-profile data breaches linked to its platform. Incidents affecting services such as Ticketmaster and Santander have previously been connected to attacks involving the company's systems, making the mere mention of Snowflake a significant detail in the current case.

What makes this episode particularly striking is the public manner in which the alleged breach has been revealed. Cyber criminals typically conduct extortion attempts and negotiations away from public view, hoping that discretion will encourage a quiet payment and reduce the risk of law enforcement involvement or reputational fallout for the victim.

Instead, the Asos notification thrust the demand into the open, reaching users' lock screens before the company had a chance to respond or even confirm whether an attack had taken place. The group behind the message is reportedly calling itself Xuanye Group, and its Telegram channel was created only recently, having posted just three times, with the latest entry concerning the Asos incident.

Dan Bird, from the cyber-security firm Horizon3, said the push notification implies the criminals' access extended beyond a single database. He explained that sending a notification to Asos app users would require control of the company's notification system, which is separate from the Snowflake data platform the attackers claim to have compromised.

Bird said that if both claims prove accurate, it would suggest the attackers obtained credentials that opened more than one door into the organisation's infrastructure. That assessment raises the possibility of a broader security failure rather than an isolated incident, although it remains unverified while Asos stays silent.

For shoppers, the immediate concern is what the message means for their personal information. The notification itself did not specify what data might have been accessed or how many customers could be affected, and no evidence has yet emerged publicly to confirm that any information was actually taken.

The incident also highlights a wider vulnerability in how consumers interact with branded apps. Push notifications occupy a position of unusual trust on mobile devices, often appearing alongside messages from friends, banks and employers. When that channel is abused, it can lend criminal demands an air of legitimacy they would not otherwise possess.

Cyber-security specialists frequently warn that the initial breach is only part of the damage in such cases. Reputation, customer confidence and regulatory scrutiny can all suffer, particularly when a company is slow to communicate what has happened and what steps users should take to protect themselves.

The BBC has invited readers who may have been affected to get in touch as it continues to cover the story. The broadcaster also maintains a technology newsletter tracking major developments in the sector, reflecting the level of public interest in incidents that touch ordinary consumers directly.

Asos has yet to clarify whether the notifications were genuinely sent through its systems, whether Snowflake data was involved, or whether customer information is at risk. Until the company responds, the episode remains a confusing and unsettling experience for users who simply opened an app to browse clothing and were met instead with what looked like a criminal ransom note.