Asos App Hacked: Shoppers Hit by Ransom Push Notifications as 'Xuanye Group' Claims Snowflake Breach

Shoppers across the United Kingdom have reported receiving alarming push notifications from the Asos mobile app that appear to have been sent by cyber criminals attempting to extort the online fashion and beauty retailer. The incident, which emerged on Tuesday, has prompted widespread confusion among customers and raised serious questions about the security of the company's internal systems.

Dozens of users contacted the BBC after the unusual messages appeared directly on their phone screens, seemingly delivered through Asos's own official notification channel rather than a third-party platform. The message, written in English and addressed to specific members of the company's technical staff, contained an explicit threat and a demand for engagement.

"Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it," the notification reportedly stated. The message was addressed to Asos's data protection officer and its information technology team, although it was delivered to ordinary members of the public rather than the intended recipients.

Asos did not immediately respond to requests for comment from the BBC, leaving customers and security researchers speculating about the scope of the apparent intrusion. The retailer, which is headquartered in London, operates one of the UK's largest online fashion platforms and holds extensive personal and financial data belonging to millions of shoppers.

The reference to "the Snowflake instance" points to the US-based cloud data storage company Snowflake, whose technology is widely used by major corporations to collect, analyse and store vast quantities of information. It remains unclear whether Asos is a Snowflake customer, or what data, if any, the retailer actually stores with the service.

Snowflake has nevertheless been linked to a string of high-profile data breaches in recent years, including incidents affecting the ticketing giant Ticketmaster and the Spanish bank Santander. Those cases have made the company's name familiar to security professionals and, increasingly, to the public.

Charlotte Wilson, head of enterprise at the cyber-security firm Check Point, described the incident as a significant escalation if the breach is confirmed. She said the attackers appeared to have done something unusually bold: converting Asos's own app into a vehicle for their ransom demand. Wilson noted that millions of consumers place their trust in app notifications precisely because they are expected to originate directly from the company itself.

That trust, she suggested, is exactly what makes the tactic so effective. A message delivered through a trusted brand's official channel carries an air of legitimacy that a random email or text message would struggle to match, potentially pressuring the company into a swift response.

On social media, dozens of users posted screenshots and comments about the notification, expressing bewilderment about what the message meant and whether their personal data had been exposed. Many said they had initially assumed the alert was a phishing attempt, only to realise it had arrived through the legitimate Asos app.

The message included a link directing recipients to a Telegram channel operated by the apparent attackers. The group, which calls itself Xuanye Group, is newly established. According to the BBC, the Telegram channel was created only on the day the notifications were sent and contained just three posts, the most recent of which concerned the Asos incident.

The public nature of the extortion attempt marks a departure from the typical behaviour of cyber criminals. Most ransomware negotiations and blackmail efforts are conducted quietly and privately, with attackers preferring discretion in the hope of securing a discreet payment without attracting the attention of regulators, law enforcement or the media.

Dan Bird, of the cyber-security firm Horizon3, said the push notification implied that the intruders had gained access beyond a single database. He explained that sending a notification to Asos app users would require control of the company's notification system, which operates separately from the Snowflake data platform the attackers claim to have compromised.

Bird added that if both claims prove accurate, it would suggest the attackers obtained credentials granting access to more than one part of the company's infrastructure. Such a scenario would point to a broader security failure rather than an isolated vulnerability.

The incident raises difficult questions for Asos about how its notification system was accessed and whether customer data has been exposed. Push notifications are typically generated through internal marketing or engineering tools and are distributed to devices via platforms such as Apple's and Google's mobile operating systems, meaning any compromise would require access to privileged systems.

For consumers, the immediate concern is whether personal details such as names, addresses, payment information or account credentials have been affected. The company has not yet confirmed the extent of any data loss, and the hackers' claims remain unverified.

The BBC has invited readers who were affected by the incident to get in touch, reflecting the unusually public nature of the case. The story has also prompted broader discussion about the security of cloud infrastructure that underpins much of modern e-commerce.

The case highlights a growing trend in which attackers combine data theft with aggressive public pressure tactics designed to embarrass victims and accelerate payment. Whether Asos will confirm the breach, and what it will tell its customers, remains to be seen as the company faces mounting scrutiny over its response.