ASOS Customers Hit by Bogus Push Notifications in Apparent Ransomware Extortion Attempt

Shoppers using the ASOS mobile app across the United Kingdom have reported receiving unsolicited pop-up messages that appear to have been sent by cyber criminals attempting to extort the online fashion retailer. The messages appeared directly on users' phone screens, prompting confusion and concern among recipients who had not anticipated any unusual activity from the clothing and beauty brand.

The notification, delivered through the company's own app, was addressed to ASOS's data protection officer and IT department rather than to customers themselves. It claimed that the sender had "fully compromised the Snowflake instance" and warned that unless the company engaged with them, stolen data would be leaked publicly. The message also included a link directing users to a Telegram channel operated by the alleged attackers.

Dozens of ASOS customers contacted the BBC after receiving the notification. Many took to social media to share screenshots and express bewilderment about what the message meant and whether their personal information was at risk. ASOS did not immediately respond to requests for comment from the BBC, leaving customers and security researchers awaiting official clarification.

Charlotte Wilson, head of enterprise at cyber-security firm Check Point, described the incident as deeply alarming, noting that the attackers had transformed ASOS's own app into a tool for delivering their ransom demand. She emphasised that the trust users place in app notifications is central to the seriousness of the breach, because such alerts are normally assumed to originate directly from the company itself.

The reference to Snowflake in the message points to the cloud-based data storage company whose tools are widely used by businesses for collecting, analysing and retaining large volumes of information. It remains unclear whether ASOS is a Snowflake customer or what data, if any, the retailer stores on the platform. Snowflake has nonetheless featured prominently in several high-profile data breaches in recent years, including incidents connected to Ticketmaster and Santander.

The public nature of this apparent extortion attempt is highly unusual. Cyber criminals typically conduct negotiations privately, hoping that discretion will encourage victims to pay quietly and avoid reputational damage. In this case, however, the attackers appear to have deliberately broadcast their demands to a mass audience through push notifications, raising the stakes and increasing pressure on the company.

The message directed recipients to a newly created Telegram channel belonging to a group calling itself Xuanye Group. According to the BBC, the channel was established on the same day the notifications were sent and contained only three posts, the most recent of which concerned the alleged ASOS hack. The group's sudden appearance and limited posting history suggest it may be a newly formed operation seeking attention or credibility.

Dan Bird, from cyber-security firm Horizon3, said the push notification implied that the attackers had gained access beyond the Snowflake database alone. He explained that sending a notification to ASOS app users would require compromising the company's notification system, which operates separately from the data platform the attackers claimed to have breached. If both claims prove accurate, he said, it would indicate the attackers obtained credentials that unlocked multiple systems.

For ASOS customers, the incident raises immediate questions about the security of their personal and payment information. The company holds extensive data on millions of shoppers, including names, addresses, order histories and payment details. Any compromise of that information could expose customers to fraud, phishing attempts and identity theft, making swift and transparent communication from the retailer essential.

The incident also highlights broader vulnerabilities in the ecosystem of third-party services that retailers rely on. Cloud storage platforms, marketing tools and notification systems are frequently interconnected, meaning that a single set of compromised credentials can allow attackers to move laterally across multiple environments. Security experts have long warned that supply-chain and third-party risks are among the most difficult threats for companies to detect and contain.

Push notifications have become a routine channel for communication between brands and consumers, used for promotions, delivery updates and account alerts. That familiarity is precisely what makes them attractive to attackers. A message delivered through an official app carries an implicit seal of authenticity, making recipients far more likely to trust its contents than they would an unsolicited email or text message.

The timing and method of the apparent attack suggest a deliberate strategy aimed at maximising publicity and embarrassment for ASOS. By alerting customers directly, the perpetrators may hope to force a faster response from the company while also demonstrating their reach. Such tactics can backfire, however, as they often provoke regulatory scrutiny and law enforcement involvement.

It remains unknown how many users received the notification or whether the attackers genuinely accessed any sensitive systems. The BBC reported that it could not verify the claims made in the message, and neither ASOS nor Snowflake had issued a public statement at the time of publication. The truth of the situation may only emerge once the company completes an internal investigation.

Should the breach be confirmed, ASOS may face obligations under UK data protection law to notify regulators and affected individuals within strict timeframes. Companies that fail to safeguard customer data can face substantial fines, as well as legal action from consumers and reputational harm that lingers long after the technical incident has been resolved.

The BBC has invited readers who were affected by the hack to get in touch through its contact form, reflecting significant public interest in the story. As the situation develops, customers are likely to watch closely for guidance from ASOS on whether their accounts or personal information have been impacted and what steps they should take to protect themselves.

For now, the incident stands as a stark reminder that even well-known retailers with sophisticated digital operations can become targets of aggressive cyber extortion. The coming days will determine whether the hackers' claims are substantiated, and how ASOS responds to what may prove to be one of the more brazen attacks on a major British retailer in recent memory.