Asos Hack Push Notifications: Data Claim & Shares Fall 14%

British online fashion retailer Asos is investigating a suspected cyberattack after thousands of app users received a rogue push notification on 6 October 2026 titled “Asos hacked,” claiming that the company’s data had been “fully compromised.” The Asos hack push notifications, delivered through Asos’s own mobile app and linking to Telegram, sent shares tumbling more than 14% intraday before closing down 9.56% on the London Stock Exchange.

What Happened in the Asos Hack?

At approximately 10 a.m. on Tuesday, customers worldwide received an unauthorised push notification that appeared to come from Asos. The message, addressed to the retailer’s data protection officer and IT team, read: “We have fully compromised the Snowflake instance. Engage with us, or we will leak it.” It was signed by “xuanyewengateway” and contained a link to a Telegram channel controlled by a previously unknown group calling itself Xuanye.

Asos confirmed the “unauthorised customer notification” and said it was investigating “unauthorised access involving third-party platforms” used to communicate with customers. The company restricted access to those notification platforms and said its website and app remained operational. The UK National Cyber Security Centre (NCSC) is assisting with the investigation, according to The Guardian.

The incident highlights the growing risk of retail cybersecurity threats targeting customer-facing channels, where attackers can amplify data-leak claims directly to millions of users.

Why Did Asos Shares Fall 14%?

Investors reacted swiftly. Asos shares dropped more than 14% during intraday trading on 6 October 2026, before recovering slightly to close down 9.56%. The company is a constituent of the FTSE 250 Index, and the apparent breach raised immediate concerns about customer trust, potential regulatory fines, and remediation costs.

Asos said it was “too early” to quantify any trading impact and noted that it carries cybersecurity insurance. The visible use of its own app to deliver the threat amplified market anxiety, reflecting patterns seen in other FTSE 250 retailers after security incidents.

How the Attack Worked: Third-Party Notification Platforms and Snowflake

Security researchers believe the attackers may have gained access not to Asos’s core systems, but to the third-party marketing and customer-communication platforms that trigger push notifications. Asos reportedly uses Simon AI, which runs on Snowflake, and Braze to send personalised messages to app users, according to Malwarebytes.

What is Snowflake?

Snowflake is a cloud-based data platform used by companies to store and analyse large datasets. In this incident, the Xuanye group claimed it had “fully compromised the Snowflake instance,” but Snowflake said it found no breach of its platform. This suggests the entry point may have been a misconfigured integration or a compromised third-party vendor, rather than Snowflake itself.

The abuse of the Snowflake data platform in supply-chain attacks has become a recurring theme in 2026, as threat actors target marketing automation tools to reach customers directly.

Customer Impact and Asos Response

Asos said that names and contact details may have been accessed, but it does not believe payment card records or passwords were compromised. Potentially exposed information includes addresses, phone numbers, email addresses, customer numbers, and birth dates — data that could fuel follow-up phishing attempts.

The retailer urged customers to disregard the rogue notification and not click its Telegram link. Experts advise taking these steps:

1. Ignore unsolicited breach messages and do not click links.
2. Change your Asos password and enable two-factor authentication.
3. Monitor bank and email accounts for unusual activity.
4. Remove the Asos app if unwanted notifications continue.

Asos apologised and said its website and app remain safe to use. The NCSC and law enforcement are involved, and the company is working with cybersecurity specialists. Customers should also review phishing attack prevention guidance to avoid follow-up scams.

Expert Perspectives

Jake Moore, global cybersecurity advisor at ESET, told Infosecurity Magazine: “This could be among the most visible hacks we have seen... It looks like a pressure tactic for extortion.” He added that customers should not click the link and should avoid the Telegram channel.

Malwarebytes advised users to postpone purchases from Asos for now and to treat any unsolicited breach messages as suspicious. The case underscores the importance of robust cybersecurity incident response plans for third-party vendor compromises.

FAQ

What happened in the Asos hack?

On 6 October 2026, Asos app users received a push notification titled “Asos hacked” claiming company data had been fully compromised. Asos is investigating unauthorised access to third-party customer-notification platforms.

Was Asos payment data compromised?

No. Asos said it does not believe payment card records or passwords were compromised, although names and contact details may have been accessed.

Why did Asos shares fall 14%?

The rogue notification spooked investors, sending shares down more than 14% intraday before closing down 9.56% on the London Stock Exchange.

What should Asos customers do?

Ignore the notification, do not click the Telegram link, change passwords, enable two-factor authentication, and monitor accounts for unusual activity.

Conclusion

The Asos hack push notifications represent a new escalation in cyber extortion: using a brand’s own app infrastructure to broadcast breach claims to millions of customers. The incident highlights the need for stronger third-party vendor security and faster customer notification. Asos’s investigation, supported by the NCSC, will determine whether any data was actually stolen or leaked. Follow our app push notification security coverage for ongoing updates.