Asos confirms customer data theft after hackers push alert through its app
Asos, the British online fashion retailer, confirmed in a London Stock Exchange filing on Oct. 6 that hackers broke into a third-party platform it uses to communicate with customers and took names and contact information. The admission came after users of the Asos app received an unauthorized push notification from the attackers.
Asos says it has about 17 million customers. The case shows how extortion groups are using a victim's own channels to pressure it in public.
What happened
Over a couple of days, U.K. users of the Asos app received pop-ups titled "ASOS hacked." The message was addressed to the company's data protection officer and IT team, claimed the attackers had "fully compromised the Snowflake instance" and warned that the data would be leaked unless the company engaged, according to SecurityWeek.
Asos said it restricted access to its notification platforms and was working with internal and external specialists and the relevant authorities. It said it did not believe payment card information or account passwords were affected, and that its website and app kept operating normally. The company did not name the compromised platform.
TechCrunch reported that the data was hosted on Snowflake, which said its own systems were not breached. BBC News reported that the stolen data also included home addresses, phone numbers, email addresses and notes on customer profiles such as website search queries.
TechCrunch noted that fintech firm Betterment was compromised earlier in 2026 through a third-party marketing platform that hackers used to send a cryptocurrency scam to customers, a similar pattern of abusing a company's messaging tools.
Who is behind it
A group calling itself Xuanye Group claimed the attack on a newly created Telegram channel. It has not said how much data it holds. A Forescout researcher told SecurityWeek the name suggests a Chinese-speaking actor but could be a false flag. How the attackers reached both the Snowflake data and the push notification system is still unclear.
What to do
Asos customers, including those outside the U.K., should treat emails, texts or app messages about orders, refunds or the breach with caution and sign in only through the official app or website. Companies that store customer data in cloud data platforms should enforce multi-factor authentication on every account and review who can send in-app notifications.
