British on-line style retailer ASOS is investigating unauthorised exercise after attackers used its official cell app to ship threatening notifications on to clients.
The notification, titled “ASOS HACKED,” appeared on clients’ telephones on October 6, 2026. Screenshots shared by a number of recipients confirmed the identical message:
“Pricey ASOS DPO and IT, we’ve got totally compromised the Snowflake occasion. Interact with us, or we are going to leak it.”
The notification included a hyperlink to a Telegram channel operated by a beforehand unknown hacking group calling itself Xuanye Group.
The Telegram hyperlink included within the unauthorised ASOS notification didn’t open the group’s important channel immediately. It first led to a gateway channel, which instructed guests to comply with a second hyperlink to what Xuanye Group described as its legit broadcast channel.
Hackread.com reviewed each channels. Within the broadcast channel, the operators warned about impersonation and stated the gateway would publish a alternative hyperlink if the primary channel was eliminated.
The group then posted that ASOS clients’ cost data was not affected. In a later “closing assertion,” it claimed the ASOS app was protected to make use of and stated the incident concerned buyer data held on its server.
“The incident entails buyer data; it’s protected on our server, and it’ll not be touched for a chosen interval,” the message said.
The Telegram posts help the group’s declare that buyer information was taken, however they don’t show the kind, quantity or authenticity of the knowledge. Xuanye Group has not printed a pattern of the alleged information, and ASOS has solely stated that names and speak to particulars could have been accessed.
ASOS later acknowledged that an unauthorised push notification had been despatched and requested clients to ignore it. The corporate restricted entry to the affected notification platforms and commenced working with cybersecurity specialists and related authorities.
Buyer Names and Contact Particulars Could Have Been Accessed
In a assertion reported by Reuters, ASOS stated it was investigating unauthorised exercise involving third-party platforms used to speak with clients.
“Fundamental private data together with title and speak to particulars could have been accessed,” the corporate stated. “We don’t consider that payment-card data or account passwords had been impacted.”
ASOS has not disclosed what number of clients obtained the notification or what number of information could have been accessed. It additionally has not named the third-party communication platforms concerned.
The retailer’s web site and app continued working usually, with no disruption reported to orders or different enterprise operations.
Entry to the push-notification system confirms that the attackers reached at the least one service related to ASOS buyer communications. Nevertheless, ASOS has not defined whether or not that entry got here by compromised credentials, a third-party account or one other safety failure.
Xuanye Group Claims Snowflake Entry
Xuanye Group claimed in its Telegram channel that it had accessed ASOS buyer data saved in a Snowflake occasion. The group additionally stated cost data was not affected and that the ASOS app remained protected to make use of.
“The incident entails buyer data, it’s protected on our server, and it’ll not be touched for a chosen interval,” the group claimed.
These statements haven’t been independently verified. The group seems to be new, with no established historical past on main cybercrime boards or leak websites earlier than the ASOS incident.
Snowflake launched its personal investigation after studying in regards to the notification. An organization spokesperson stated it had discovered no proof that the Snowflake platform itself had been compromised.
That assertion doesn’t settle whether or not attackers accessed a person buyer atmosphere hosted on Snowflake. Earlier incidents involving Snowflake clients resulted from attackers acquiring credentials for particular person accounts, not from a breach of Snowflake’s central infrastructure.
In 2024, attackers accessed information belonging to at the least 165 Snowflake clients, together with AT&T, Ticketmaster and Santander. Investigators linked these incidents to stolen credentials and accounts that lacked multifactor authentication. Hackread.com beforehand reported on the arrest of a suspected hacker related to these assaults.
No proof presently connects Xuanye Group with the hackers concerned within the 2024 marketing campaign.
NCSC Helping ASOS
The UK’s Nationwide Cyber Safety Centre is offering help to ASOS. NCSC chief government Richard Horne stated the unauthorised notification confirmed how cyber incidents affecting giant firms may have an effect on people.
ASOS shares fell by about 10% after the incident grew to become public, having dropped by greater than 14% throughout buying and selling. The corporate stated it holds cyber insurance coverage, together with business-continuity protection, however couldn’t but calculate any impact on buying and selling.
Prospects ought to ignore the Telegram hyperlink included within the notification and deal with sudden emails, textual content messages or calls referring to ASOS accounts and orders with warning. Names and speak to particulars might help criminals produce convincing phishing messages even when passwords and cost data haven’t been accessed.
ASOS clients ought to get hold of updates by the retailer’s official web site or app and keep away from getting into credentials by hyperlinks obtained by electronic mail, textual content message or social media.
