ASOS App Push Notices Claim Hack as Shares Fall More Than 10%
UK listed retailer ASOS saw shares fall more than 10% after its mobile app delivered a push notice claiming a breach and threatening to leak data. The company confirmed unauthorized customer notifications, said basic personal data may have been accessed, and stated that payment cards and passwords appear unaffected.
Incident
On 9 October 2026, shares in UK online fashion retailer ASOS fell more than 10% after customers reported a push notification sent through the ASOS application claiming the company had been hacked. BBC reporting estimated that millions of users received the message. ASOS has about 16.5 million active users. The company said it was still investigating and that the number of affected users was not yet certain.
Screenshots circulated on social media showed a notice titled "ASOS hacked." The text addressed ASOS's data protection officer and IT department, claimed full control of a Snowflake instance, and demanded contact under threat of data leakage. The notice included a Telegram link to a channel named Xuanye Group.
Security researchers who track ransomware groups said they had not previously seen that name. Such groups typically contact a victim privately before publishing stolen data or claiming responsibility.
Claims and Lack of Proof
A Xuanye Group Telegram channel introduction described the channel as the group's official outlet and warned users about impersonation accounts. It said that if the main channel were removed, a separate entry channel would point to a replacement.
A later post on the channel said payment information was not affected in the ASOS incident. In a subsequent statement the group said the company's application could be used safely, that the incident involved customer information stored on company servers, and that the information would not be published within a "specified period."
The group offered no evidence for those claims. It did not say what information it held, or whether it held any. The Telegram channel published neither customer-data samples nor other material that could independently support the statements.
Company Response and Market Move
Charlotte Wilson, an executive at cybersecurity firm Check Point, said that if confirmed the incident would be extremely serious, and that using ASOS's own application as the extortion channel was especially brazen. She noted that the share-price drop showed investors pricing in possible consequences before the company had publicly confirmed what had occurred.
ASOS is listed on the London Stock Exchange. Late Tuesday afternoon it issued a regulatory announcement. The company confirmed that someone had sent unauthorized notifications to customers. It said it was investigating unusual activity on third-party platforms used to communicate with customers.
ASOS said it had restricted access to the affected notification platforms and was working with specialist advisers and relevant authorities. It said basic personal information such as names, multiple contact details, and dates of birth may have been accessed. It currently believes payment-card information and account passwords were not affected.
The company said its website and application were operating normally. It also said it was too early to judge what business impact the incident might have.
Attackers claimed control of ASOS's Snowflake data-infrastructure instance but provided no proof. ASOS has not independently confirmed that claim in the materials cited. The company framed the confirmed issue around unauthorized customer notifications and anomalous activity on third-party communications platforms.
Sources cited in the original report include The Record and BBC News.