ASOS breach: when a shopping notification becomes a ransom threat

ASOS customers expecting an order update or a sale alert received something very different on October 6: an unauthorized push notification headed “ASOS HACKED.”

The message claimed attackers had compromised the retailer’s Snowflake database and threatened to leak data unless ASOS engaged with them. It directed recipients to a Telegram channel associated with a group calling itself Xuanye. By using the retailer’s own notification channel, the attackers put their threat directly in front of customers.

ASOS has since confirmed that customer information was accessed. Here’s what is known — and what customers should watch for next.

In an update to customers, ASOS said an attacker impersonated a trusted contact to obtain an employee’s login credentials. Those credentials were then used to access information on third-party platforms.

The exposed information included names, contact details, and certain account-related information. ASOS said payment-card information and account passwords were not accessed, and that its website and app remain safe to use.

Receiving the rogue notification does not, by itself, mean your phone or operating system was hacked. The incident involved unauthorized access to platforms used by ASOS, including its customer communications channel.

The attackers’ claim brings back memories of the 2024 campaign targeting Snowflake customer accounts, which affected companies including Ticketmaster, Santander, and AT&T.

Mandiant’s investigation linked that campaign to stolen customer credentials. It found no evidence that the activity resulted from a breach of Snowflake’s enterprise environment. Accounts without multifactor authentication were among those targeted.

That distinction matters here, too. A claim that an ASOS Snowflake instance was compromised is not proof that Snowflake’s platform itself was breached. The current incident should be judged on confirmed findings, rather than the attackers’ announcement.

Names and contact details may sound less sensitive than passwords or bank-card numbers. But they can give scammers a convincing starting point.

A follow-up message could offer “compensation” for the breach, ask you to verify your account, or direct you to a fake password-reset page. A caller could use your real name while pretending to be ASOS support.

These are potential follow-up tactics, not confirmed consequences of this incident. The risk is that a genuine breach gives fraudulent messages a believable backstory.

ASOS says it will never ask customers to share passwords, security codes, or payment details through an unsolicited message or call.

You do not need to engage with the attackers or assume your device is compromised. Focus on verifying communications and keeping your accounts secure.

A familiar logo, your real name, or even a notification from a shopping app should not replace verification. If a message asks you to act urgently, pause and check the request directly.