Shares in British clothing company ASOS dive after hackers apparently send push notification

Shares in British online fashion retailer ASOS fell more than 10% on Tuesday after customers reported receiving a push notification through the company’s app saying the business had been hacked.

Screenshots shared on social media showed a notification titled “ASOS HACKED” that said: “Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.”

The notification linked to a Telegram channel calling itself Xuanye Group, a name not previously seen by experts who track cyber extortion groups. Such groups typically contact companies privately before publishing stolen data or publicly claiming responsibility for a breach.

The people behind the message provided no evidence that they had compromised ASOS’s Snowflake cloud data environment.

Charlotte Wilson, an executive at cybersecurity company Check Point, said: “If confirmed, this is a deeply serious attack because the hackers appear to have done something particularly brazen: turned ASOS’s own app into their ransom note.”

She said that the rapid way ASOS shares tumbled after the alert was sent showed how “before the company had even publicly established what had happened, investors were already pricing in the potential consequences.”

ASOS, which is traded on the London Stock Exchange, published a regulatory statement late on Tuesday afternoon.

The company confirmed an unauthorized customer notification had been sent and said it was investigating activity involving third-party platforms used to communicate with customers.

The company said it had restricted access to the affected notification platforms and was working with specialist advisers and relevant authorities.

It said basic personal information, including names and contact details, may have been accessed, but that it did not believe payment-card information or account passwords were affected.

ASOS said its website and app were operating normally and that it was too early to quantify any potential impact on trading.

An introductory post on the Telegram channel described it as Xuanye Group’s official broadcast outlet, warned about impersonators and said a separate “gateway” channel would direct users to a replacement if the main channel was removed.

A later post said: “Regarding ASOS, payment information is not affected.”

In a later statement, Xuanye Group said the affected company’s app was safe to use and claimed the incident involved customer information held on its servers, which it said would not be released for a “designated period.”

The group provided no evidence for that claim and did not specify what information, if any, it had obtained. The Telegram channel contained no samples of customer data or other material that independently supported the group’s claims.

Editor’s Note: Story updated 11:45 a.m. Eastern U.S. time with additional comments from Xuanye Group and ASOS.