ASOS Reports Unauthorized Platform Access Following Push Notification Incident
UK fashion retailer ASOS confirmed Tuesday that third-party platforms used to communicate with customers were accessed without authorization. Hackers sent unauthorized push notifications through the official mobile app at approximately 5:00 a.m. Eastern Time that day. The messages read "ASOS HACKED" and claimed the attackers had compromised the Snowflake instance. ASOS states that basic personal information, including names and contact details, may have been exposed. The company says it does not believe payment-card information or account passwords were impacted.
Unauthorized Notifications Sent Through Official App
Multiple mobile app users received identical push alerts Tuesday morning reading "ASOS HACKED" followed by a message addressed to ASOS's data protection officer and IT team. The notification stated that attackers had fully compromised the Snowflake instance and threatened to leak data if ASOS did not engage with them. Reports on Reddit and other platforms indicated many users received the alert.
ASOS now displays a notice within the app warning customers to disregard the unauthorized push alert. The company advises users not to click or interact with the external link the notification contained. The notification directed recipients to a Telegram channel operated by a group calling itself the Xuanye group.
Company Statement on Compromised Platforms
ASOS confirmed that third-party platforms used to communicate with customers were accessed without authorization. The company states that basic personal information, including names and contact details, may have been exposed. ASOS has not confirmed the threat actor's claim that its Snowflake environment was compromised.
The company has not disclosed how many customers may be affected. ASOS states it does not believe payment-card information or account passwords were impacted. The retailer sells clothing, footwear, accessories and beauty products to customers worldwide, including in the United States.
Attacker Claims Remain Unverified
The group posted messages to its Telegram channel Tuesday morning claiming the breach did not affect payment information. In a later statement labeled "FINAL STATEMENT," the attackers claimed they stole customer information and stated it is safe on their server and will not be touched for a designated period.
The group did not specify what customer information was allegedly stolen or how many customers were affected. They did not provide evidence of having compromised ASOS's Snowflake environment. The only contact point for the threat actors required payment, preventing independent verification.
How Communication Systems Were Exploited
The incident demonstrates how attackers can abuse third-party communication platforms to reach customers through trusted channels. By compromising the systems ASOS uses to send push notifications, the attackers delivered messages that appeared to come from the official app.
The public nature of the notification reached many or all app users. ASOS responded by posting an in-app warning about the unauthorized message. Customers reported seeing the alert on Reddit and contacted news outlets about it.
Snowflake Environment Claims
The attackers specifically claimed to have compromised ASOS's Snowflake instance. ASOS has not confirmed whether its Snowflake environment was actually compromised. The source material does not describe Snowflake or what data may have been stored there.
Without evidence or official confirmation, it is not possible to determine whether the breach extended to a data warehouse platform or was limited to the communication platforms ASOS confirmed were accessed.
Steps for ASOS Customers
Do not click on any links contained in the unauthorized notification. ASOS has warned users to disregard the message. If your name and contact details were exposed, remain alert for phishing attempts that use your personal information.
Monitor your ASOS account for unusual activity. Consider changing your password as a precaution. Be cautious of emails, text messages or calls claiming to be from ASOS that request personal information or payment details. Legitimate companies will not ask you to verify sensitive information through unsolicited messages.
- Do not click links from the unauthorized notification
- Monitor your ASOS account for unusual activity
- Consider changing your password as a precaution
- Watch for phishing attempts using your personal information
- Ignore unsolicited requests for personal or payment information
Questions readers ask
Did ASOS confirm that payment information was stolen in the breach?
No. ASOS states it does not believe payment-card information or account passwords were impacted. The attackers also claimed in their Telegram channel that the breach did not affect payment information, though they provided no evidence to support their claims.
How many ASOS customers were affected by the incident?
ASOS has not disclosed how many customers may be affected. Reports from social media suggest that many mobile app users received the notification, but the company has not provided a specific number.
Did the attackers actually compromise ASOS's Snowflake environment?
ASOS has not confirmed the threat actor's claim that its Snowflake environment was compromised. The attackers did not provide evidence of access to the Snowflake platform, and it is not clear whether the breach extended beyond the third-party communication platforms.
What should I do if I clicked the link in the notification?
Do not enter any personal information on any site that opened. Close the page immediately. Monitor your ASOS account and email for suspicious activity. Consider changing your password and watch for phishing attempts. If you provided information, contact ASOS customer support through official channels.
What is the Xuanye group that sent the notification?
The Xuanye group is the name used by the threat actors who posted to the Telegram channel linked in the notification. The group claimed to have stolen customer information but provided no evidence. Their only contact point required payment.
Source and reporting limits
Based on reporting by BleepingComputer. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.