Asos App Users Hit by Ransom-Style Push Notifications Claiming Data Breach

Customers of the online fashion and beauty retailer Asos have reported receiving unsolicited push notifications through the company's mobile app that appear to have originated from cyber criminals attempting to extort the business. The messages, which surfaced on phone screens across the United Kingdom, have left recipients confused and raised urgent questions about the security of the retailer's internal systems.

According to accounts shared with the BBC, the notification read: "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it." The wording suggests the intruders are directing their demand at Asos's data protection officer and its technology team, rather than at shoppers themselves.

Asos did not provide an immediate response to the BBC's requests for comment, leaving the precise nature and scope of the apparent intrusion unconfirmed. The company has so far said nothing publicly about how the notifications were dispatched or whether customer information has been exposed.

Charlotte Wilson, head of enterprise at the cyber-security firm Check Point, described the incident as potentially very serious. She noted that the attackers appear to have done something especially bold by converting Asos's own app into a channel for their ransom demand. Wilson added that millions of consumers place their trust in app notifications precisely because they assume such messages come straight from the company operating the service.

The unusual method of delivery has amplified concern among security professionals. Instead of quietly approaching a victim organisation, the perpetrators have broadcast their threat to a wide audience of ordinary shoppers, a tactic that is rare in the world of digital extortion, where negotiations are normally conducted out of public view.

The reference to a "Snowflake instance" points to the cloud data platform Snowflake, whose tools are relied upon by numerous organisations to gather, examine and store large volumes of information. It remains unclear whether Asos is a Snowflake customer or what data, if any, the retailer keeps on the service.

Snowflake has nonetheless been connected to several prominent data breaches in recent years. The platform has been linked to incidents affecting other major organisations, including the ticketing giant Ticketmaster and the banking group Santander, which has made its name a familiar reference point in discussions about large-scale cyber intrusions.

Typically, criminal groups seeking payment prefer to keep their demands private, hoping that discretion will encourage a swift and quiet settlement. The decision to notify customers directly is therefore highly irregular, and analysts say it may signal either frustration with the target or a deliberate attempt to apply public pressure.

The notification included a link directing users to a Telegram channel operated by the purported attackers. The group refers to itself as Xuanye Group and established its Telegram presence only on the day the messages began appearing. So far it has published just three posts, the most recent of which concerns the claimed Asos hack.

Dan Bird, of the cyber-security firm Horizon3, said the push notification implies that the intruders' access extended beyond the Snowflake database alone. He explained that sending a notification to Asos app users would require control of the company's notification system, which operates separately from the Snowflake data platform the attackers say they compromised. If both claims prove accurate, Bird added, it would suggest the attackers obtained credentials capable of opening more than one door into the organisation.

That assessment underlines a key worry for investigators: the possibility that the breach is not confined to a single system. Access to a notifications platform and to a cloud data warehouse would represent two distinct footholds, each with its own security controls and its own potential consequences for the company and its customers.

On social media, dozens of users posted about the puzzling messages, asking one another what they meant and whether their personal details were at risk. The sudden appearance of a ransom note on personal devices has a particularly unsettling effect, because it reaches people in a space they normally associate with shopping updates and promotional offers.

The incident also illustrates how dependent modern retailers have become on interconnected digital infrastructure. App notifications, customer databases, cloud storage and third-party analytics services form a chain in which a weakness at any link can have visible consequences for the public-facing brand. When attackers can speak directly to shoppers, the boundary between a corporate security failure and a consumer-facing incident quickly dissolves.

For Asos, the immediate priorities will include establishing how the notifications were sent, whether any data was actually taken, and what steps are needed to prevent further messages. The company may also face questions from regulators, particularly given that the message specifically names its data protection officer and threatens to leak information.

Cyber-security experts say the case is likely to renew scrutiny of how organisations protect the credentials and systems that control mass communications with customers. A push notification channel is a powerful tool: it can reach millions of devices instantly, and if it falls under hostile control, it can be turned into an instrument of intimidation rather than a means of engagement.

Whether the attackers genuinely hold sensitive data, and how much, remains unknown. The claim of a "fully compromised" Snowflake instance is, for now, an assertion made by an anonymous group with a newly created online presence. Verifying such claims typically takes time and involves forensic examination of corporate systems.

What is already clear is that the episode has shaken confidence among some users and drawn attention to a form of attack that blends data theft with direct public messaging. As investigations continue, customers and security analysts alike will be watching closely for Asos's response and for any indication of how far the intrusion truly reached.