Asos has launched an investigation into unauthorized activity within its app systems after thousands of users received alarming push notifications claiming the retailer’s data was “fully compromised.” The incident, which occurred amid a broader cybersecurity concern, triggered a sharp 14% decline in the company’s share price on the London Stock Exchange, though the stock later recovered to settle at an 11% loss. The value of Asos’s shares on the London Stock Exchange dived more than 14% after thousands of customers received a notification titled “Asos hacked” with a link that sent them to the Telegram messaging service. It also enables push notifications to phones.
The company stated it is probing unauthorized access involving third-party platforms used for customer communication. Asos moved quickly to restrict access to these notification services and is collaborating with internal experts, external advisers, and relevant government authorities. While the retailer confirmed basic personal data like names and contact information may have been accessed, it maintains that payment card details and passwords remain secure. According to it, In a statement: “We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers. And if the situation changes an update will be provided as appropriate.”, customer trust is incredibly important to us.
The breach notifications directed shoppers to a Telegram channel managed by a group calling itself the Xuanye Group. In their messages, the attackers claimed to have compromised a Snowflake instance—a cloud platform Asos uses for processing demographic information and managing customer alerts. The hackers stated that while customer information was taken, payment details were not affected, and they claimed to have set a deadline for the company. The post added: “The incident involves customer information, it is safe on our server, and it will not be touched for a designated period.”, indicating that Asos had been set some form of deadline. I strongly advise shoppers to watch out for targeted phishing attempts while we wait for official confirmation of a data breach.”.
Sophos principal threat researcher Aiden Sinnott noted that the Xuanye Group appears to be a new entity seeking to establish credibility within the cybercriminal ecosystem through high-profile disruption. Experts like Huntress security manager Dray Agha described the move to send extortion demands directly to consumer devices as an aggressive tactic designed to force immediate corporate negotiation.
Despite the incident, Asos emphasized that its core website and mobile app remain fully operational with no current disruption to business. The company confirmed it holds cybersecurity insurance, including business continuity coverage, though it remains too early to determine the ultimate impact on trading results. “Our website and app are operating as normal, with no current disruption to any aspects of our operations.
The National Cyber Security Centre is currently providing assistance to the retailer as it addresses the fallout. Security analysts warn that this event creates a prime environment for secondary fraud. NordVPN’s chief technology officer, Marijus Briedis, cautioned consumers to remain vigilant against phishing attempts, such as fake emails or texts asking for password resets or payment confirmations, which often follow high-profile data incidents.
This event follows a trend of significant cyber incidents affecting prominent British retailers, including Harrods, the Co-op, and Marks & Spencer over the past year. In those previous cases, retailers faced substantial operational hurdles, including prolonged website closures and stock management issues.
