Asos App Push Notifications Hijacked by Hackers in Brazen Extortion Attempt

Users of the Asos mobile app across the United Kingdom have reported receiving alarming pop-up notifications that appear to have been sent by cybercriminals attempting to extort the online fashion and beauty retailer.

Dozens of individuals contacted the BBC after a strange message appeared on their phone screens via the company's official app. The notification was pushed directly to customers, seemingly without any authorization from Asos itself.

The message, addressed to the company's data protection officer and IT department, reads: "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it." Asos did not immediately respond to requests for comment from the BBC.

Security experts have described the incident as highly unusual and deeply concerning. Charlotte Wilson, head of enterprise at cyber-security firm Check Point, said: "If confirmed, this is a deeply serious attack because the hackers appear to have done something particularly brazen: turned ASOS's own app into their ransom note." She added that "millions of people trust notifications from apps on their phones because they are supposed to come directly from the company."

The apparent extortion message, though delivered to customers, is specifically directed at Asos' data protection officer and IT team. It claims the unnamed attackers have "fully compromised the Snowflake instance" — a reference to the data storage company Snowflake, whose tools are widely used by businesses for collecting, analysing, and storing data.

It remains unclear whether Asos is a customer of Snowflake or what data, if any, the retailer stores with the service. However, Snowflake has been at the centre of numerous high-profile data breaches in recent years. The company's systems have been linked to incidents affecting other major organisations, including Ticketmaster and Santander.

The public nature of this apparent breach is highly unusual. Most cyber extortions and negotiations are conducted privately, with hackers typically hoping that discretion will result in a quiet pay-off from the targeted company. In this case, the attackers have chosen to expose their demands directly to the public through the retailer's own notification system.

The pop-up message reportedly contains a link to the hackers' Telegram channel. The group behind the message is calling itself Xuanye Group, and according to the BBC, it only created its Telegram channel on the same day the notifications were sent. So far, the group has posted only three times, with the latest post concerning the Asos hack.

Dan Bird, from cyber-security firm Horizon3, noted that the method of communication implies the attackers' access may extend beyond the Snowflake database. He explained: "Sending a push notification to ASOS's app users would require access to the company's notification system, which is separate from the Snowflake data platform the attackers claim to have compromised."

Bird further suggested that if both claims are accurate, it indicates the attackers obtained credentials that granted them access to multiple systems within the company's infrastructure. "If both claims hold up, it suggests the attackers got hold of credentials that opened more than one door," he said.

On social media, dozens of users have posted about receiving the notification, expressing confusion about its meaning and concern about the security of their personal data. The incident has raised questions about how the attackers managed to access the company's notification system and whether customer data has been compromised.

The BBC has been seeking further information about the scale of the potential breach and whether any customer information has been exposed. The company has not yet issued a public statement addressing the situation.

For customers, the incident raises immediate concerns about the security of their accounts and personal information. Push notifications are typically reserved for legitimate communications from companies, such as order updates, promotional offers, or delivery notifications. The fact that hackers were able to exploit this channel has alarmed both users and security professionals.

The incident also highlights the growing threat posed by cybercriminal groups targeting major retailers. High-profile data breaches have become increasingly common, with attackers often seeking financial gain through extortion or the sale of stolen data on dark web marketplaces.

The involvement of a newly formed group calling itself Xuanye Group adds another layer of concern. Newly established cybercriminal operations often attempt to make a name for themselves by targeting well-known companies and executing high-impact attacks.

The BBC is continuing to gather information about the incident and has invited readers who have been affected to get in touch. The full scope of the breach and its potential impact on Asos customers and the company's operations remains to be determined.