When the Ransom Note Arrives Through Your Own App

On the morning of October 6, ASOS app users in the UK and several other markets received a push notification from the retailer they normally hear from about new arrivals and discount codes. This one read “ASOS HACKED.” It was addressed to the company’s Data Protection Officer (DPO) and IT team, claimed the attackers had “fully compromised the Snowflake instance,” and threatened to leak data unless ASOS made contact through a Telegram channel. 

Within the hour, ASOS shares had fallen by more than 10%. The attackers had not published a single record. 

What We Know So Far

ASOS confirmed that afternoon that an unauthorized notification had been sent and that it was investigating activity on third-party platforms it uses to communicate with customers. It restricted access to those platforms and said names and contact details may have been exposed. It does not believe payment card data or account passwords were affected. 

On October 8, the company explained how the attackers got in. Someone impersonated a trusted contact and persuaded an ASOS employee to hand over the login credentials for their work account. Those credentials gave the attackers access to the customer communication platforms. ASOS has notified the Information Commissioner’s Office, which is assessing the incident. 

​​The Snowflake claim remains unproven. Snowflake says its investigation found no compromise of its platform, and the group behind the message, calling itself Xuanye Group, has released no sample data. Whether sample records appear in the coming days will go a long way toward settling the question. In the meantime, the UK’s National Cyber Security Centre (NCSC) has advised ASOS customers to assume they may be affected, whether or not they received the notification.​​​ 

Why AI Raises the Bar

​​The stakes of that incident are higher than the basic dataset suggests. Retailers building AI-driven personalization increasingly centralize behavioral, transactional, and demographic data into a single customer profile. ​Those profiles make recommendations sharper and marketing more relevant. In an attacker’s hands, they do the same for fraud. ​​     ​​ 

​​​​Attackers no longer have to write tailored lures by hand. In a field experiment with more than 7,700 participants, researchers from BIFOLD and TU Berlin, working with Inria and Ruhr University Bochum, found that personalized, AI-generated phishing achieved 2.4 times the click rate of generic phishing​.​​ 

​​​The communication tools at the center of the ASOS incident deserve the same attention. Customer engagement platforms that segment, personalize, and send messages on a retailer’s behalf hold both the customer data and the means to reach every customer at once. That combination makes them a target in their own right. ​​ 

Extortion With an Audience

Extortion crews usually open with a private message to the victim. Negotiation happens behind closed doors, and the public learns about a breach, if at all, through a leak site or a regulatory filing. 

The ASOS attackers reversed that order. They told the customers first and brought the media and investors to watch before ASOS had confirmed anything. Even if the group held no data at all, a single push notification created market pressure for ASOS and shortened their time to respond publicly. That delay caused customer doubt and market pressure for ASOS. 

The choice of channel compounds the damage. Customers opt in to app notifications because they trust the sender. Security awareness training teaches people to check the sender’s address or hover over a link, but a message delivered through the genuine app on their own phone passes those checks. Every misuse of that channel makes it less dependable for the legitimate messages a retailer needs to send, including future breach notifications. 

What This Means for Customers

The most likely follow-on is phishing. Criminals routinely exploit the publicity around a breach by sending fake refund offers, password reset requests, and breach notification emails that lead to credential-harvesting pages. ASOS customers should treat any unexpected messages about the incident with suspicion, avoid the Telegram link, and check their accounts by opening the app or website directly. Changing reused passwords and turning on two-step verification will stop the most common account takeover attempts before they start. 

What This Means for Retailers

The attackers did not come through the ASOS website or app. They came through an employee’s credentials, and the third-party tools connected to them. A retailer’s attack surface includes corporate and development networks, customer data platforms, SaaS applications, service accounts, communication tools, and the vendors connected to these environments. 

Every organization depends on its vendors’ security practices, which makes due diligence a continuing obligation. Every vendor integration can expand an organization’s attack surface and introduce additional risk, so each one needs to be carefully vetted and regularly reviewed. Risk assessments belong at the point of vendor selection and at regular intervals afterward, along with a clear record of which vendor accounts can reach customers directly. This is an ongoing effort, not a one-time project. Regular reviews help keep that picture current and identify changes that could introduce new risks. 

Those reviews should also cover who has access to customer communication channels. Push notification services through owned apps, SMS gateways, and email platforms can reach millions of people in seconds, so retailers need a clear record of which vendor accounts can send messages directly to customers. They should protect those accounts with phishing-resistant MFA, and have a tested way for quickly revoking access. Keeping control of these channels also gives retailers a trusted way to reach customers and set the record straight when something goes wrong.  

Regulation is pulling in the same direction. Since September 11, 2026, the EU Cyber Resilience Act has required manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents to ENISA and national CSIRTs within 24 hours. This requirement now holds retailers accountable for the security of the apps they ship, but the platforms that send messages through those apps often sit with vendors that the regulation doesn’t reach. 

​​For ASOS, rebuilding trust means showing customers that both their data and the channels used to reach them are secure. For other retailers, this is a stark reminder to look across their vendor relationships, understand what each provider can access, and make sure they can respond quickly if that access is misused.​