12OCT

ASOS app pushes rogue alert to customers

3 min read

10:55UTC

An unauthorised push notification went out through the ASOS app on 6 October, and the NCSC told every ASOS customer to assume they are affected.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyDeveloping

Key takeaway

The NCSC told every ASOS customer to assume their name and contact details were exposed.

ASOS customers received an unauthorised push notification from the online retailer's app on 6 October⁠¹. The UK National Cyber Security Centre (NCSC) told every ASOS customer the same day to assume they are affected, whether or not the message reached them. ASOS said names and contact details were accessed, and that it does not believe payment cards or account passwords were. No customer count has been published.

ASOS told City A.M. that an unauthorised party obtained an employee's login credentials by "impersonating a trusted contact", then used them to reach information on third-party platforms the retailer uses⁠². The rogue notification claimed the attackers had broken into ASOS's account with Snowflake, the cloud data-storage company, and Snowflake said it found no compromise of its own platform. A Telegram channel run under the name Xuanye Group claims to hold the customer data; nobody has verified that claim. ASOS shares fell more than 13 per cent on 6 October, City A.M. reported.

ASOS has named no group. Posing as someone the target trusts is the same opening Mandiant documented in April for UNC6692, which posed as IT support on Microsoft Teams. A push notification arrives inside an app the customer installed, which makes a follow-up fraud message more convincing than an email. The NCSC advises treating links in push notifications with the same suspicion as links in email; ASOS has referred the incident to law enforcement and regulators.

Deep Analysis

In plain English

ASOS is a UK online fashion shop with millions of customers who mostly use its phone app. On 6 October some customers got a strange alert from the ASOS app. It was sent by hackers, not by ASOS. The company says the hackers got hold of customers' names and contact details, but not card numbers or passwords. ASOS says the attackers tricked a member of staff into handing over their login by pretending to be someone the employee trusted. The UK's National Cyber Security Centre (NCSC) told everyone with an ASOS account to assume their details were taken and to be careful with any message that seems to come from ASOS.

Deep Analysis

Root Causes

Retailers spread customer data across many software-as-a-service platforms for analytics, marketing and app messaging. Each holds a slice of the customer base behind staff logins, so one tricked employee can open several stores of data at once.

Push-notification services are built to reach every installed app in seconds and are rarely guarded as tightly as payment systems. Whoever holds the sending credentials holds a trusted channel to the entire customer base.

Impersonating a trusted contact defeats training that tells staff to distrust strangers, because the request appears to come from someone they already deal with.

What could happen next?

Risk
Scammers holding real names and contact details can send phishing that reads as genuine ASOS correspondence for months.
Short term · Assessed
Consequence
UK retailers are likely to review who holds sending rights on their app notification platforms.
Short term · Suggested
Precedent
The NCSC issuing a consumer alert naming a single retailer sets an expectation for similar alerts after future UK breaches.
Medium term · Suggested

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In August 2022 Twilio disclosed that employees had been tricked by text messages into entering their logins on fake sign-in pages. The attackers used those logins to reach customer data in Twilio's internal tools, and through Twilio reached Signal, which said some users' phone numbers had been exposed. Logins taken from a few staff spread harm to the customers of the platform they opened.

Counter-parallel: Marks & Spencer's April 2025 attack also began with social engineering of staff, but reached core systems: online orders stopped for about seven weeks and M&S estimated a £300m hit to operating profit. ASOS so far reports contact data taken and trading intact, a narrower outcome from a similar entry.

ASOS shares fell more than 13 per cent on 6 October, then recovered about 4 per cent to 469p on 8 October after the company said payment details and passwords were not taken. The market priced the incident as a reputational blow rather than a trading one.

The larger cost risk sits with the Information Commissioner's Office, which can fine up to 4 per cent of global turnover under UK data-protection law, and with any rise in customer churn if follow-on scams spread.

Consensus view: ASOS told City A.M. that an unauthorised party obtained a staff member's login by 'impersonating a trusted contact' and used it to reach information on third-party platforms the retailer uses; ASOS has not named those platforms. The NCSC's instruction that every customer assume exposure reflects the reach of a push channel that touches the whole app base at once.

Counter-view: The rogue notification sent on 6 October claimed the attackers had compromised ASOS's Snowflake instance, while Snowflake said it found no compromise of its own platform; neither ASOS nor any investigator has resolved the two statements. A Telegram channel under the name Xuanye Group claims the data, which nobody has verified and which links to no established crew.

Key tension: Which third-party platforms the stolen login opened, and whether the push-notification service was among them or reached by a second route.

Sources:NCSC·City AM

Mentions:ASOS →NCSC →Snowflake →City AM →Telegram →Mandiant →Microsoft →Xuanye Group →Information Commissioner's Office →United Kingdom →Twilio →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

NCSC· 12 Oct 2026

Read original →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.