Asos customers hit by rogue push notifications in apparent extortion attempt

Shoppers across the United Kingdom have reported receiving alarming pop-up alerts through the Asos mobile app, in what appears to be an attempt by cyber criminals to pressure the online fashion retailer into paying a ransom. The messages, which surfaced on users' phone screens, were sent via the company's own notification system — a channel normally reserved for order updates and marketing offers.

The alert, addressed to Asos's data protection officer and IT department, states that the attackers have "fully compromised the Snowflake instance" and warns that unless the company engages with them, stolen data will be leaked. Dozens of customers have contacted the BBC to describe receiving the unusual notification.

Asos has not yet issued a public statement on the matter and did not respond immediately to requests for comment from the BBC. The company has also not confirmed whether its systems have been breached or whether any customer information has been accessed.

Charlotte Wilson, head of enterprise at cyber-security firm Check Point, described the incident as highly unusual because the attackers appear to have used Asos's own app as the vehicle for their demand. She noted that millions of consumers instinctively trust notifications delivered through official apps, since these are expected to originate directly from the company itself. Turning that trusted channel into a ransom note, she said, makes the attack particularly brazen if the breach is confirmed.

The notification has puzzled many recipients, who took to social media to ask what the message meant and whether their personal data was at risk. Although the demand is addressed to Asos's internal teams, it was delivered en masse to ordinary customers, blurring the line between a corporate security incident and a public-facing disruption.

The reference to a "Snowflake instance" points to Snowflake, a US-based cloud data storage company whose tools are widely used by businesses to collect, analyse and hold large volumes of information. It remains unclear whether Asos is a Snowflake customer, and if so, what kind of data might be stored on the platform.

Snowflake has been connected to a number of major data breaches in recent years, including incidents affecting Ticketmaster and Santander. Those cases typically involved attackers obtaining credentials rather than exploiting a flaw in Snowflake's own infrastructure, highlighting how stolen login details can open doors to sensitive corporate data.

What stands out in this case is the public nature of the apparent extortion. Most cyber-criminal negotiations take place behind closed doors, with attackers preferring discretion in the hope of securing a quiet payment. Announcing a breach directly to a retailer's customer base is a far more confrontational approach.

The pop-up message reportedly includes a link directing users to a Telegram channel operated by a group calling itself Xuanye Group. According to the source article, the channel was created on the same day the notifications were sent and contains only three posts, the most recent of which concerns the claimed Asos hack.

Dan Bird, from cyber-security firm Horizon3, said the push notification suggests the attackers may have reached beyond the Snowflake database they claim to have compromised. He explained that sending a notification to Asos app users would require access to the company's notification system, which operates separately from the data platform. If both claims are accurate, he said, it would indicate the attackers obtained credentials granting access to more than one system.

The incident raises broader questions about how retailers secure the digital tools that connect them to customers. Push notifications are a routine part of mobile commerce, used to confirm purchases, flag deliveries and promote sales. A compromise of that pipeline could allow attackers to reach huge audiences instantly, potentially spreading phishing links or disinformation alongside ransom demands.

For consumers, the immediate concern is whether any personal or financial details have been exposed. The source article does not establish what data, if any, was taken, and the hackers' claims have not been verified. Asos has yet to clarify whether the notifications were sent through a compromised internal system or via a third-party service.

The BBC is inviting readers who were affected by the incident to get in touch through its contact form, as the company continues to face questions about the security of its app and the data it holds. Until Asos responds, the scope and impact of the apparent attack remain uncertain.