Hackers Hijacked the ASOS App on Your Phone to Send You a Threat

Your Phone Buzzed. The Hackers Sent That.

On October 6, 2026, millions of ASOS shoppers picked up their phones and read a push notification from the official ASOS app. It said: "ASOS HACKED, we have fully compromised the Snowflake instance. Engage with us, or we will leak it."

That notification did not come from ASOS. It came from the people who broke in.

That is not a typo. Attackers used ASOS's own customer notification system to broadcast a ransom threat to every shopper who had the app installed. They didn't sneak out the back door with data. They grabbed the megaphone.

How Did Hackers Get Control of ASOS's Notifications?

They didn't hack the ASOS app itself. They compromised the third-party platform ASOS used to send push notifications to customers.

Here's how the chain works. When a company like ASOS wants to send you a notification, it doesn't build that infrastructure from scratch. It pays a third-party vendor to manage it. That vendor's system connects to your phone through the official app. When the vendor's credentials get stolen, whoever holds those credentials can send notifications to everyone on the list.

The group calling themselves the Xuanye group claimed on Telegram that they had breached ASOS's Snowflake cloud data environment. Snowflake denied any compromise of its own platform. What actually happened was more targeted: attackers appear to have used stolen credentials or exploited a third-party tool to gain access. The exact entry point matters less than the result. They got in. They had the keys to the notification system. And they used them loudly.

ASOS confirmed that attackers gained unauthorized access to a third-party communication platform used to send customer notifications. The company said names and contact details were potentially exposed.

What Information Was Actually Taken?

ASOS was clear on two things the attackers did not get: payment card information and account passwords were not affected.

That is genuinely good news. It means you do not need to cancel your card because of this breach. Your login credentials were not in the exposed data.

What was potentially exposed is still serious. Names and contact details. That is enough for phishing campaigns, targeted scams, and social engineering. If someone knows your name, your email, and that you shop at ASOS, they can craft a convincing fake email pretending to be ASOS security, asking you to "verify your account" or "confirm your address for a refund."

ASOS shares fell 13% on the day of disclosure. Investors read the notification stunt as a demonstration of how deep the attackers had reached.

Why a Trusted App's Notification Is No Longer a Safe Signal

This is the shift worth understanding. You have been trained, reasonably, to treat push notifications from apps you installed as trustworthy. You gave the app permission. The notification comes from the brand. That logic held up until it didn't.

What this incident proves is that the trust runs through a supply chain. The app trusts the notification vendor. The notification vendor trusts whoever holds the API credentials. If any link in that chain breaks, the notification you receive may carry a message you were never supposed to see, or worse, a message designed to manipulate you.

The Xuanye group did not just breach ASOS. They used the breach to prove they had breached ASOS. A threat delivered through your trusted app is worth more to an extortionist than a threat delivered through an anonymous email. It creates panic. It creates pressure. It creates exactly the headlines that put a company's share price down 13% in one day.

What You Should Do Right Now

1. Do not click anything in an unusual notification. If a notification from any app asks you to verify information, take urgent action, or follow a link, go directly to the company's official website instead. Open a browser, type the address manually, log in from there.

2. Check your ASOS account for anything unfamiliar. Look at recent orders, saved addresses, and any linked payment methods. If something looks wrong, remove it and contact ASOS support directly through the official site.

3. Turn on two-factor authentication on your ASOS account. If someone does get your email and password from a different breach, 2FA stops them from logging in. Do this on every shopping account you have.

4. Watch your email for phishing attempts. Attackers with your name and email address will try to use that combination. Be skeptical of any email claiming to be ASOS in the coming weeks, especially ones that ask you to act quickly or enter credentials.

5. Consider a passkey where it's available. Passkeys replace passwords with cryptographic keys tied to your device. They cannot be phished. Not every site supports them yet, but more do every month.

6. If you want to go further, freeze your credit. Your financial data was not taken in this breach, but a freeze costs nothing and blocks anyone from opening credit in your name. You can lift it in minutes when you need to apply for something.

The Systemic Truth Behind This Incident

Every app on your phone is a node in a network of dependencies. The app you trust is only as secure as the vendors it depends on, and most companies do not audit those vendors the way they audit their own code.

You cannot fix that. But you can stop treating a push notification as proof of legitimacy. The name on the notification and the face of the brand mean nothing if the underlying plumbing has been taken over.

The Xuanye group sent their ransom demand to millions of phones because it was the loudest thing they could do. Next time, attackers might send something quieter. A link to a fake login page. A "security alert" asking you to re-enter your card details. The delivery mechanism is the same.

Do this now: Enable 2FA on your ASOS account, check for unfamiliar saved addresses, and treat any urgent notification from any brand with skepticism until you can verify it independently.

Sources

• bleepingcomputer.com
• securityweek.com