ASOS SHARES FALL MORE THAN 10% INTRADAY AFTER UNAUTHORIZED APP NOTIFICATION CLAIMS COMPANY WAS HACKED

Shares of British online fashion retailer ASOS fell more than 10% on Tuesday after customers received an unauthorized push notification through the company’s mobile application claiming that attackers had compromised company data infrastructure and threatening to leak information if ASOS did not engage with them.

Screenshots circulated online showing a notification titled “ASOS HACKED.” The message was directed toward the company’s data-protection and information-technology personnel and claimed that the attackers had fully compromised an ASOS Snowflake environment.

The notification also attempted to direct recipients to a Telegram channel operated under the name Xuanye Group, an entity that had not previously established a significant public profile among known cyber-extortion operations.

The individuals behind the notification offered no evidence demonstrating that they had actually compromised ASOS’s Snowflake cloud environment.

The unauthorized notification confirms access to a customer-communications channel, but it does not establish access to ASOS’s broader infrastructure.

ASOS later confirmed that an unauthorized customer notification had been sent and disclosed that it was investigating unauthorized activity involving third-party platforms used to communicate with customers.

The company said it moved to restrict access to the affected notification platforms and began working with internal and external specialists as well as relevant authorities.

ASOS also acknowledged that basic personal information, including names and contact details, may have been accessed.

The company said it did not believe payment-card information or customer account passwords had been affected.

At this stage, ASOS has acknowledged unauthorized activity involving customer-communication platforms and the potential exposure of basic customer information. It has not publicly confirmed the attackers’ claim that its Snowflake environment was fully compromised.

The company’s website and application continued operating normally following the incident, and ASOS reported no broader operational disruption.

The ability of an unauthorized party to transmit a message directly to customers through a legitimate company notification channel remains significant even without confirmation of a deeper infrastructure breach.

Push-notification systems operate as trusted communications channels between companies and their customers. A message delivered through the genuine ASOS application can carry greater credibility than an ordinary phishing email because the recipient sees it arriving through software they already associate with the company.

That creates a separate security concern beyond the underlying data-access investigation.

If attackers gain access to a legitimate notification platform, they can potentially use the organization’s own communications infrastructure to deliver fraudulent instructions, malicious links, extortion messages, or other content directly to customers.

In the ASOS incident, the unauthorized message appears to have been used primarily as a public pressure tactic aimed at the company rather than as a conventional attempt to deceive customers into providing passwords or payment information.

The message told ASOS personnel to make contact or face the release of allegedly stolen information, effectively turning the customer notification channel into part of the extortion attempt.

The incident also had an immediate financial dimension.

ASOS is publicly traded on the London Stock Exchange, and its shares dropped more than 10% after reports of the notification circulated.

The market reaction occurred before the company had completed its investigation or established publicly whether the attackers’ broader claims were genuine.

That demonstrates how rapidly a cybersecurity incident can move beyond an information-technology problem and become a corporate financial event.

Publicly traded companies can face investor uncertainty within minutes when an apparent breach affects customer-facing systems, particularly when attackers themselves use those systems to announce the alleged compromise.

ASOS subsequently issued a regulatory statement confirming the unauthorized notification and the investigation into third-party communication platforms.

The company said it was still too early to determine what effect, if any, the incident could have on trading.

The attackers’ reference to Snowflake also requires careful treatment.

Cloud data platforms can store significant volumes of business and customer information, making claims involving those environments potentially serious. In this case, the attackers have not publicly produced evidence showing that they obtained access to ASOS’s Snowflake deployment.

There were no public samples of allegedly stolen ASOS customer records accompanying the claim, and the Telegram channel did not provide technical evidence demonstrating access to the environment.

The Telegram channel associated with Xuanye Group described itself as the organization’s official broadcast channel and warned users about impersonators. It also referred users to a separate gateway channel that could redirect followers if the main channel was removed.

That type of communications structure can help an extortion operation preserve contact with followers and potential victims if a platform removes or restricts one of its channels.

Xuanye Group later stated that payment information connected to ASOS was not affected.

The group also claimed the ASOS application remained safe to use and asserted that the incident involved customer information it had obtained and was holding on its own server.

The group said the information would not be released for a designated period but provided no supporting evidence and did not disclose what categories or quantities of information it allegedly possessed.

ASOS said it does not believe payment-card data or account passwords were affected; the company has not confirmed the threat actor’s broader claims.

The investigation now centers on determining exactly what systems were accessed through the affected third-party communication infrastructure, what information may have been exposed, how the unauthorized party obtained access, and whether the activity extended beyond the notification platforms.

Investigators will need to determine how the unauthorized party gained access to the affected communication platform.

Another important question will be whether the attacker maintained access after the notification was sent.

Restricting access to affected platforms can help stop immediate misuse, but incident-response teams still must determine when unauthorized access began, which accounts or credentials were used, what administrative actions occurred, whether information was exported, and whether persistence mechanisms were established.

ASOS’s acknowledgement that names and contact information may have been accessed also creates potential risks for affected customers even if financial information and passwords remain secure.

Contact information can be useful in later phishing, impersonation, social-engineering, or credential-harvesting campaigns because attackers can build convincing messages around information already associated with a genuine customer relationship.

Customers should therefore treat unexpected communications claiming to involve ASOS accounts, refunds, order problems, security verification, or password resets with additional caution while the investigation continues.

The incident illustrates a broader weakness in modern digital commerce: customer communication systems have become part of an organization’s security perimeter.

Retailers depend on outside platforms for notifications, messaging, marketing, analytics, customer engagement, cloud storage, authentication, and other functions. Compromise of one connected platform can create a trusted route to customers even when the company’s principal website, application infrastructure, and payment systems continue operating.

For ASOS, the most significant confirmed facts remain narrower than the attackers’ public claims.

An unauthorized customer notification was sent. Unauthorized activity involving third-party communication platforms is under investigation. Some basic personal information may have been accessed. ASOS does not currently believe payment-card information or account passwords were affected, and its website and application remained operational.

The full scope of the incident will depend on what ASOS and investigators determine about the affected third-party systems, the data accessed through them, and whether the intrusion extended into additional parts of the company’s infrastructure.

---

---

ASOS plc, Update regarding cyber incident, Regulatory News Service, October 6, 2026. (Free Download)

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---