Hackers Hijack ASOS App to Send Extortion Message to Customers Across the UK

Shoppers using the ASOS mobile app in the United Kingdom have reported receiving unexpected push notifications that appear to have been sent by cyber criminals attempting to extort the online fashion and beauty retailer. The messages surfaced directly on users' phone screens, leaving many customers confused and alarmed by the sudden intrusion into a service they had trusted for years.

The notification, written in the style of a ransom demand, was addressed not to shoppers but to the company's data protection officer and IT department. "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it," the message reportedly stated. It also included a link directing recipients to a Telegram channel operated by the individuals behind the apparent attack.

Dozens of affected users contacted the BBC to describe their experience of receiving the strange pop-up, while many others took to social media to express bewilderment about what the message meant and whether their personal information was at risk. ASOS did not immediately respond to requests from the BBC for comment, leaving customers and security researchers waiting for official clarification.

The incident has drawn intense scrutiny from cybersecurity professionals, who describe it as an unusually bold and public form of digital extortion. Charlotte Wilson, head of enterprise at the security firm Check Point, said the attack, if confirmed, would be deeply serious because the perpetrators appear to have turned ASOS's own application into a ransom note. She noted that millions of people place their trust in app notifications precisely because they are supposed to originate directly from the company operating the service.

The reference to a "Snowflake instance" has become a central focus of the investigation. Snowflake is a cloud-based data storage company whose tools are widely used by businesses to collect, analyse and hold large volumes of information. It remains unclear whether ASOS is a customer of Snowflake, or what data, if any, the retailer stores on the platform, but the mention has raised concerns given the company's recent history.

Snowflake has been connected to a series of high-profile data breaches in recent years, including incidents involving Ticketmaster and the banking group Santander. Those episodes have made the platform a recurring name in discussions about supply-chain security, where attackers target third-party providers to reach multiple victim organisations at once.

What makes the ASOS case particularly notable is the manner in which the alleged breach has been disclosed. Cyber criminals typically conduct extortion negotiations in private, hoping that discretion and quiet pressure will lead to a swift payment. Publicly announcing an intrusion through a company's own customer-facing channels is highly unusual and suggests either a deliberate attempt to maximise pressure or a desire to humiliate the target.

The group claiming responsibility has identified itself as Xuanye Group. According to the source article, the group's Telegram channel was created only on the day the notifications were sent, and it has published just three posts, the most recent of which concerns the ASOS hack. The newness of the channel offers little insight into the group's track record, resources or credibility, though security analysts will be watching closely for further posts.

Dan Bird, from the cybersecurity firm Horizon3, pointed out that sending a push notification to ASOS app users would require access to the company's notification system, which operates separately from the Snowflake data platform the attackers claim to have compromised. In his assessment, if both claims prove accurate, it would suggest the attackers obtained credentials that opened more than one door inside the organisation's infrastructure.

That distinction matters because it hints at a broader security failure than a single compromised database. Gaining control of a notification system typically involves access to application programming interfaces, administrative accounts or service credentials, all of which are guarded differently from stored data. If intruders managed to reach both systems, investigators will want to understand how credentials were obtained, how far the access extended and how long the intruders remained undetected.

For ASOS customers, the immediate concern is whether personal details such as names, addresses, payment information or account credentials have been exposed. At this stage, the source article does not confirm any data theft, and it is not known what information, if any, was stored in the allegedly compromised environment. The company has yet to issue a statement clarifying the scope of the incident or advising users on protective steps.

The episode also raises broader questions about the security of mobile push notifications as a communication channel. Consumers generally treat app alerts as trustworthy because they arrive through official software, but that trust can be exploited if an attacker gains control of the underlying messaging infrastructure. Security experts often urge companies to treat notification systems as critical assets requiring the same level of protection as databases and internal networks.

Regulatory implications may follow as well. Under UK data protection rules, organisations are typically required to report certain types of personal data breaches to the Information Commissioner's Office within 72 hours of becoming aware of them, and to inform affected individuals where there is a high risk to their rights and freedoms. How ASOS responds in the coming days, including whether it notifies regulators and customers, will be closely examined.

The BBC has invited readers who were affected by the hack to get in touch, reflecting the widespread reach of the notifications. For now, the situation remains fluid, with no confirmed statement from ASOS and no verified evidence detailing the extent of any intrusion. Security teams and customers alike will be awaiting official word on whether the extortion claim is genuine and what it means for the data of millions of shoppers.