U.K.-based fashion retailer Asos has confirmed a data breach following a cyberattack that led hackers to send unauthorized push notifications via the company’s own app. The hackers claimed to have fully compromised Asos’ cloud storage and issued a direct warning to the company’s data protection and IT teams. This breach was announced in a filing to the London Stock Exchange, revealing that attackers accessed customer names and contact information by exploiting a third-party platform used by Asos for customer communications.

Reports indicate that the stolen information includes detailed personal data such as home addresses, phone numbers, emails, and notes on customer profiles, including search queries on the Asos website. By sending messages through the official app, the hackers—operating under the name Xuanye Group—attempted to pressure Asos into engagement under threat of releasing the data publicly. The incident has sparked concern among Asos' 17 million customers and security experts alike.

The breach occurred after the attackers gained access to Asos’ Snowflake cloud data environment, apparently by impersonating a trusted contact to steal login credentials. While Snowflake confirmed no breach of its core systems, it remains unclear whether Asos had enabled multi-factor authentication on its Snowflake account or how exactly the cybercriminals accessed the push notification system. This sophisticated social engineering attack echoes a similar incident earlier this year when fintech firm Betterment experienced a comparable breach involving a third-party marketing platform.

Asos is currently assessing the full extent of the data exposure and working to enhance its security measures in response. The incident highlights increasing risks companies face when relying on third-party services and the potential for exploited communication channels to amplify the impact of breaches. Customers have been urged to monitor their accounts for suspicious activity and remain cautious of any unexpected messages linked to this incident.