← Blog

ASOS Breach: Hackers Push ‘HACKED’ Alerts to App Users

Tue Oct 06

Share on X

ASOS, the UK online fashion retailer, confirmed a data breach on October 6, 2026 after customers woke up to official-looking mobile alerts titled “ASOS HACKED”. The company says third-party platforms used to communicate with customers were accessed without authorization and that basic personal information including names and contact details may have been exposed. ASOS has not confirmed the actor’s claim that its Snowflake data platform was fully compromised, and it has not published an affected-customer headcount. Primary coverage: BleepingComputer, The Guardian, and ASOS’s investor/press channels. Canonical record: https://breachhistory.com/asos/asos-xuanye-push2026 (/asos/asos-xuanye-push2026).

This is a verified ASOS data breach in the narrow sense that matters for customers and regulators: the retailer admitted unauthorized access to messaging infrastructure and possible exposure of identity and contact fields. Separately, a Telegram-facing actor calling itself the Xuanye Group claimed full compromise of an ASOS Snowflake instance and threatened to leak customer information. Treat the Snowflake theft narrative as an actor claim until ASOS or an independent forensic summary confirms cloud warehouse access. Payment-card data and account passwords were not described as impacted in ASOS’s public messaging.

What happened — timeline

At roughly 5:00 a.m. Eastern on Tuesday, October 6, 2026, ASOS mobile-app users began receiving push notifications through the retailer’s own app channel. Multiple readers contacted BleepingComputer; Reddit threads filled with screenshots of the same alert. The notification copy addressed ASOS’s data protection officer and IT staff, asserted that attackers had “fully compromised the Snowflake instance,” and directed engagement toward a Telegram channel.

  1. Early morning, October 6, 2026 (ET) — Unauthorized push notifications titled “ASOS HACKED” land on customer devices via ASOS’s mobile notification path.
  2. Morning, October 6 — Xuanye Group posts on Telegram claiming Snowflake compromise, saying payment data was not affected, then issues a “FINAL STATEMENT” asserting customer information sits on attacker-controlled storage for a “designated period.”
  3. October 6 daytime (UK) — ASOS confirms unauthorized activity involving third-party communication platforms, apologizes for the rogue notification, tells customers to ignore the external link, and displays an in-app warning. Shares on the London Stock Exchange fell more than 14% in The Guardian’s reporting of the market reaction.
  4. Same day — UK National Cyber Security Centre leadership publicly commented on how consumer-facing notifications make cyber incidents personal for ordinary shoppers, not only for enterprise security teams.
  5. Ongoing — ASOS works with internal and external advisers and authorities; no public census of affected customers had been indexed in English trade press at catalog time.

What remains unconfirmed

  • Whether Snowflake credentials, service accounts, or warehouse objects were actually accessed.
  • How many customer rows, if any, left ASOS-controlled systems beyond the messaging abuse.
  • Exact third-party products used for push delivery (vendor names were not highlighted in the primary BleepingComputer/Guardian summaries indexed here).
  • Whether Xuanye Group is a durable actor brand or a one-off persona built for this campaign.

What data was exposed — and what ASOS says was not

ASOS’s confirmed posture, as relayed by BleepingComputer and The Guardian, focuses on unauthorized access to third-party platforms used to communicate with customers and possible exposure of names and contact details. That field set is enough to fuel phishing, smishing, and account-recovery social engineering across any other site where customers reused the same email or phone number.

ASOS also stated it does not believe payment-card information or account passwords were impacted. That boundary is important for card-network fraud teams, but it does not make the incident “safe.” Contactable customers who just watched a fake “ASOS HACKED” banner on a trusted app are primed to click the next message that claims to be an ASOS security update.

The Xuanye Group’s Telegram messaging claimed customer information was stolen and held, while also saying payment information was not affected and that the app itself remained safe to use. Actor statements are marketing under pressure; they are not substitute for company forensics. BreachHistory catalogs the company-confirmed messaging compromise as verified and labels the Snowflake warehouse theft claim as unverified actor narrative in the technical writeup.

How the attack worked — what is known

Public reporting does not yet provide a full kill chain with CVE numbers or screenshots of Snowflake query history. What is concrete:

  • Abuse of customer notification channels. Attackers caused the official ASOS mobile app pathway to deliver a ransom-style message. That implies control or misuse of a push/notification integration — API keys, vendor admin consoles, or a compromised service account tied to mobile messaging — rather than (or in addition to) a classic storefront web-app exploit.
  • Extortion via consumer devices. Security commentators quoted by The Guardian described the tactic as aggressive: instead of emailing a corporate DPO quietly, the actor broadcast the demand to the customer base, maximizing reputational and market pressure.
  • Snowflake name-drop. Snowflake is widely used for analytics warehouses that can hold transaction histories, demographics, and marketing segments. Naming Snowflake in a push alert is designed to sound technical and credible to security teams who remember the 2024 multi-victim Snowflake credential-stuffing wave (Ticketmaster, Santander, Advance Auto Parts, and others). It does not by itself prove warehouse access in this incident.

Compare this carefully to ASOS’s earlier July 2026 credential-stuffing / account-takeover episode (~138.8K customers in trade press). That event was about recycled passwords and account access. October’s event is about messaging-platform abuse and possible contact-data exposure, with an additional unverified cloud-warehouse claim. Different root-cause class; same brand; overlapping customer anxiety.

Who is at risk

ASOS mobile-app customers

Anyone who received the rogue push — and many who did not, but shop regularly — should assume phishing will intensify for weeks. Attackers and copycats will spoof ASOS password resets, refund offers, “secure your account” SMS messages, and Telegram links that mimic the Xuanye channel aesthetic.

Customers outside the UK

ASOS sells internationally, including into the United States. Contact details are globally useful for fraud even when the retailer’s legal notices are UK-centric. If your order history, newsletter signup, or app install tied an email or phone to ASOS, treat yourself as in-scope for secondary phishing even before a formal “was I affected” letter arrives.

Employees, contractors, and marketing vendors

Whoever administers push campaigns, CRM connectors, and analytics warehouses sits on the critical path. Stolen vendor credentials remain one of the most common ways retail brands lose control of customer communications. Security teams at peer fashion retailers should re-check least privilege on notification APIs today, not after their own brand appears on Telegram.

Investors and market watchers

The share-price drop reported by The Guardian shows how a consumer-visible incident becomes a market event within hours. That feedback loop is exactly why actors choose broadcast extortion over private negotiation.

Industry and campaign context

Retail and fashion brands remain high-value targets because they hold dense contact graphs and seasonal marketing stacks glued together with SaaS. The 2024 Snowflake campaign taught attackers that naming a familiar cloud brand in a leak note accelerates media coverage. October 2026’s ASOS episode adds a twist: the ransom note arrived as a push notification inside the victim’s own app.

Related catalog context (Snowflake-era and retail peers, without equating every incident):

None of those older Snowflake rows prove that ASOS’s warehouse was hit in 2026. They explain why the actor’s wording landed with journalists and security analysts immediately.

What ASOS, regulators, and responders said

ASOS’s public statement, summarized by The Guardian, said the company was investigating unauthorized activity involving third-party platforms used to communicate with customers, took immediate action to restrict access to notification platforms, and was working with specialist advisers and relevant authorities. A customer apology asked people to disregard the unauthorized push and not click the external third-party link. An in-app warning reinforced that guidance.

BleepingComputer documented the notification text, the in-app warning screenshot, and the Xuanye Group’s Telegram messaging, including the claim that customer information would remain untouched for a designated period — classic deadline pressure without a transparent evidence package in open reporting.

NCSC commentary, as quoted in The Guardian, framed the incident as a reminder that cyber events hit individuals, not only corporate balance sheets. Independent analysts warned that the publicity window is ideal for phishing that pretends to be ASOS support, refund desks, or password-reset teams.

Action items if you shop at ASOS

  1. Ignore the rogue push and any Telegram “negotiation” links that arrived from the unauthorized notification. ASOS told customers not to engage with the external third-party link.
  2. Prefer the official ASOS app/website notice and ASOS’s own help channels for updates — not random Telegram accounts, even if they claim insider proof.
  3. Watch email and SMS for ASOS-themed phishing asking you to reset passwords, confirm card details, claim refunds, or “verify” your account after the hack headlines.
  4. If you reuse passwords on ASOS and elsewhere, change the ASOS password and any reused credentials; enable MFA wherever the account supports it.
  5. Monitor bank and card statements even though ASOS says payment cards were not believed impacted — opportunistic fraud often rides the news cycle rather than the original dataset.
  6. Treat unexpected ASOS calls or chats that cite the October incident as high-risk social engineering until you initiate contact through a known official channel.
  7. For US shoppers, consider a credit freeze or fraud alert if you later receive a notice listing SSN-adjacent fields; current public ASOS messaging emphasizes names and contact details, not government IDs.
  8. Employees and partners who manage ASOS-related marketing tools should rotate API keys, review admin audit logs on notification vendors, and confirm Snowflake service-user MFA and network policies if Snowflake is in your stack.

What this means for security teams at other retailers

Push notifications are a privileged channel. If your CRM or CDP can blast millions of devices, that integration deserves the same scrutiny as wire-transfer approvals: hardware-backed MFA for admins, IP allow lists where possible, anomaly detection on sudden full-base campaigns, and break-glass procedures that can freeze sends in minutes. A compromised notification path is both a data-privacy incident and a live disinformation channel pointed at your customers.

Snowflake and similar warehouses remain attractive because they concentrate marketing-grade identity. Even when a brand cannot confirm warehouse theft, actors will keep name-dropping those platforms because the media and investor audience already associates them with mega-breaches. Your incident-response runbooks should include a “consumer broadcast extortion” play: legal, PR, fraud, and app ops on the same bridge within the first hour.

Canonical record and sources

BreachHistory indexes this as a 2026 ASOS incident with companyConfirmed: true for the unauthorized access to customer communication platforms and possible exposure of names/contact details, recordsAffected: 0 until ASOS publishes a census, and clear separation between verified facts and the unverified Xuanye Snowflake leak claim. Full technical writeup and references live on the breach page.

If ASOS later publishes a precise headcount, Snowflake confirmation, or vendor name, the catalog row should be updated — confirmation upgrades the actor claim; silence does not convert Xuanye’s Telegram posts into company-attested fact. Shoppers asking was I affected should watch for official ASOS notices, tighten phishing hygiene now, and avoid clicking any link that arrived inside the unauthorized October 6 alert.

The broader lesson from this ASOS breach 2026 episode is uncomfortable for every consumer brand: once attackers can speak in your app’s voice, the incident is already on every lock screen in your install base. Containment is not only about disk forensics and warehouse audits — it is about reclaiming the notification pipe before the next message goes out under your name.

How this differs from a routine “website outage” story

Many shoppers first experience a cyber incident as a checkout error or a blank product page. The October ASOS event skipped that ambiguity. Customers saw a security narrative rendered through the same push channel that normally announces sales and delivery updates. That collapses the trust model: if the app can lie once, every future alert is suspect until the brand rebuilds confidence with transparent timelines and boring, official FAQs.

From a privacy-law perspective, unauthorized access to communication platforms that hold customer contact lists is still a personal-data incident even when card vaults stay sealed. Controllers must assess notification duties under UK GDPR and peer regimes based on risk of phishing and identity misuse, not only on whether CVV numbers left the building. ASOS’s early apology and in-app warning are part of that duty-of-care posture; the missing public headcount remains the gap customers notice first when they search for an ASOS data breach FAQ.

Practical checks for households that share ASOS accounts

Shared family logins complicate “was I affected” questions. If multiple people use one ASOS account on different phones, any of those devices might have shown the rogue alert. Rotate the shared password, review saved cards and addresses in the account profile for unexpected edits, and remind every user not to approve password-reset messages that arrive by SMS with urgent “post-hack” language. Teen shoppers are frequent targets for fake refund schemes that cite viral headlines.

If you use the same email for ASOS newsletters and for banking alerts, watch both inboxes. Fraudsters often pivot from a retail contact dump into “your bank noticed ASOS-related card activity” scripts. Hang up and call the number on the back of your card. Do not call numbers embedded in the suspicious text.

What BreachHistory will update next

Catalog maintenance for this row is deliberately conservative. We will raise recordsAffected above zero only when ASOS, a regulator filing, or a reputable load such as Have I Been Pwned publishes an attested figure. We will flip the Snowflake portion from actor claim to verified fact only when ASOS or a named forensic readout confirms warehouse access. Until then, the verified core remains: unauthorized use of customer notification platforms, possible exposure of names and contact details, and a high-visibility extortion spectacle aimed at the entire app install base.

Readers comparing this incident to other ASOS breach history should keep July’s credential-stuffing event and October’s push-channel abuse on separate mental shelves. Same brand, different mechanisms, overlapping advice: unique passwords, MFA, and skepticism toward unexpected ASOS security theater on your lock screen.

Blogs you may like