Online fashion retailer ASOS is investigating a potential major cyber security incident after thousands of customers received an unexpected push notification through the company’s own mobile app on the morning of 6 October 2026.
The notification, titled “ASOS hacked”, claimed that attackers had “fully compromised” the company’s Snowflake environment and threatened to leak information unless ASOS engaged with them. Customers were also directed towards a Telegram channel apparently controlled by the attackers.
At the time of writing, ASOS has not confirmed that customer information has been stolen and the full extent of the incident remains under investigation. However, the fact that an unauthorised message was apparently distributed through an official ASOS notification channel makes the incident particularly significant.
What happened?
Customers began receiving the unusual notification on Tuesday morning.
The message was addressed directly to ASOS’s Data Protection Officer and IT department rather than its customers, suggesting that the attackers may have deliberately used the company’s customer notification infrastructure as a way of publicly demonstrating access and putting pressure on the organisation.
The attackers claimed to have compromised an ASOS “Snowflake instance”. Snowflake is a cloud-based data platform used by organisations to store, process and analyse large quantities of information.
However, an important distinction needs to be made.
The ability to send a notification through the ASOS app does not prove that the attackers have obtained all of the data they claim to possess. It does, however, suggest that unauthorised access may have been achieved somewhere within ASOS’s systems, integrations or connected services.
ASOS’s website and mobile application continued to operate while the company investigated the incident.
Who is behind the attack?
The Telegram channel linked from the notification appears to identify the attackers as the “Xuanye Group”.
At present, relatively little is known about the group. Cyber security researchers quoted following the incident said the name had not previously appeared prominently within known cybercrime forums or Telegram channels.
It is therefore currently unclear whether Xuanye is an established threat actor operating under a new identity, a newly formed cybercrime group, or something else entirely.
As with any developing cyber incident, claims made by the attackers themselves should also be treated cautiously until technical evidence or information from ASOS confirms them.
Why the push notification matters
One of the most interesting aspects of this incident is not simply the alleged data breach, but the way the attackers announced it.
Rather than posting stolen information on a dark web forum or contacting ASOS privately, the attackers appear to have used infrastructure connected to ASOS itself to communicate directly with customers.
For security teams, that raises an important point: attackers do not necessarily need complete control of an organisation to cause serious disruption.
Access to a single trusted system can sometimes be enough.
Compromising services such as:
- Customer notification platforms
- Email marketing systems
- Cloud administration accounts
- CRM platforms
- Helpdesk systems
- API integrations
- Social media accounts
could allow attackers to impersonate an organisation and communicate with thousands or even millions of customers.
For businesses, securing the systems that communicate with customers can therefore be just as important as protecting traditional servers and endpoints.
The secondary threat: phishing
Even if customer passwords or payment information ultimately prove not to have been compromised, incidents like this create another immediate security risk.
Phishing.
Attackers know that ASOS customers are now expecting communications about a potential cyber attack.
That creates an ideal opportunity for other criminals to send convincing messages such as:
“Your ASOS account was affected. Reset your password.”
“Your payment information may have been compromised. Verify your card.”
“Your recent order has been cancelled. Click here for a refund.”
Security researchers have already warned that criminals may attempt to exploit the publicity surrounding the incident in exactly this way.
Customers should therefore be extremely cautious of emails, text messages and social media messages claiming to relate to the incident.
ASOS itself advises customers to use unique passwords and avoid suspicious links or requests for sensitive information.
What should ASOS customers do?
Until more information becomes available, customers should take some sensible precautions.
If your ASOS password is also used anywhere else, change it and make sure every important account has a unique password.
Customers should also be particularly cautious of messages asking them to reset passwords, provide payment details or follow links relating to the breach.
Instead of following links contained within emails or text messages, access ASOS directly through the official application or by manually visiting its website.
It is also worth monitoring email accounts, bank accounts and other online services for unusual activity.
Most importantly, customers should avoid interacting with the Telegram channel or other links contained within the original malicious notification.
What can businesses learn from the ASOS incident?
While the technical details of the incident are still emerging, there are already several important lessons for organisations.
Protect cloud identities
Modern cyber attacks increasingly focus on identities rather than individual computers.
Cloud administrator accounts, API credentials, service accounts and third-party integrations can potentially provide attackers with access to enormous amounts of information.
Multi-factor authentication, Conditional Access, strong authentication policies and careful monitoring of privileged accounts should therefore form a core part of any organisation’s security strategy.
Apply least privilege
A compromised account should not automatically provide access to every system.
Administrator permissions should only be granted where genuinely required, while service accounts and application integrations should receive the minimum permissions necessary to function.
This can dramatically reduce the potential impact of a compromised identity.
Monitor unusual administrative activity
Security monitoring should not stop at laptops and servers.
Organisations should also monitor cloud environments for activity such as:
- Unexpected administrator logins
- New API keys or application registrations
- Changes to authentication settings
- Unusual data exports
- Newly created privileged accounts
- Suspicious geographical sign-ins
- Bulk access to customer information
Detecting these behaviours early can make the difference between a contained security incident and a major breach.
Understand your third-party exposure
Most businesses now depend on dozens of cloud services.
Customer databases, marketing platforms, finance systems, CRM applications and analytics platforms may all exchange information through APIs and integrations.
Every connected system expands the organisation’s potential attack surface.
Businesses should maintain an accurate inventory of their cloud applications, understand what information each platform can access and regularly review whether integrations are still necessary.
Prepare your incident response plan before you need it
During a major incident, organisations may need to investigate systems, isolate accounts, preserve evidence, communicate with customers and meet regulatory obligations at the same time.
This is extremely difficult to organise for the first time while an attack is actively taking place.
An incident response plan should clearly establish who is responsible for technical investigation, management decisions, customer communications, legal advice and regulatory reporting.
Where a personal data breach is likely to present a risk to individuals, organisations may also be required to notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of the breach. High-risk breaches may also require affected individuals to be informed without undue delay.
Cyber security is now a business continuity issue
The ASOS incident is another reminder that cyber attacks are no longer purely an IT problem.
Within hours of the notification appearing, ASOS’s share price fell sharply while the story spread across national news outlets and social media.
Regardless of what the ongoing investigation ultimately reveals, the reputational impact began almost immediately.
For organisations of every size, cyber security therefore needs to be treated as part of wider business continuity and risk management.
Strong endpoint protection remains important, but modern security also requires protecting identities, cloud platforms, third-party applications and the systems organisations use to communicate with their customers.
For smaller organisations without a dedicated internal security team, working with an experienced MSP or MSSP can help provide continuous monitoring, vulnerability management, cloud security, incident response and guidance before an incident becomes a crisis.
This is a developing incident. Information in this article reflects what was publicly known on 6 October 2026 and may change as ASOS releases further details.