Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
Cybersecurity: Threats and Defences
22OCT

ASOS app pushes rogue alert to customers

3 min read
16:31UTC

An unauthorised push notification went out through the ASOS app on 6 October, and the NCSC told every ASOS customer to assume they are affected.

← Back to Fridge hack spoils food in seven countriesJump to analysis ↓
TechnologyDeveloping
Key takeaway

The NCSC told every ASOS customer to assume their name and contact details were exposed.

ASOS customers received an unauthorised push notification from the online retailer's app on 6 October⁠1. The UK National Cyber Security Centre (NCSC) told every ASOS customer the same day to assume they are affected, whether or not the message reached them. ASOS said names and contact details were accessed, and that it does not believe payment cards or account passwords were. No customer count has been published.

ASOS told City A.M. that an unauthorised party obtained an employee's login credentials by "impersonating a trusted contact", then used them to reach information on third-party platforms the retailer uses⁠2. The rogue notification claimed the attackers had broken into ASOS's account with Snowflake, the cloud data-storage company, and Snowflake said it found no compromise of its own platform. A Telegram channel run under the name Xuanye Group claims to hold the customer data; nobody has verified that claim. ASOS shares fell more than 13 per cent on 6 October, City A.M. reported.

ASOS has named no group. Posing as someone the target trusts is the same opening Mandiant documented in April for UNC6692, which posed as IT support on Microsoft Teams. A push notification arrives inside an app the customer installed, which makes a follow-up fraud message more convincing than an email. The NCSC advises treating links in push notifications with the same suspicion as links in email; ASOS has referred the incident to law enforcement and regulators.

Deep Analysis

In plain English

ASOS is a UK online fashion shop with millions of customers who mostly use its phone app. On 6 October some customers got a strange alert from the ASOS app. It was sent by hackers, not by ASOS. The company says the hackers got hold of customers' names and contact details, but not card numbers or passwords. ASOS says the attackers tricked a member of staff into handing over their login by pretending to be someone the employee trusted. The UK's National Cyber Security Centre (NCSC) told everyone with an ASOS account to assume their details were taken and to be careful with any message that seems to come from ASOS.

Deep Analysis
Root Causes

Retailers spread customer data across many software-as-a-service platforms for analytics, marketing and app messaging. Each holds a slice of the customer base behind staff logins, so one tricked employee can open several stores of data at once.

Push-notification services are built to reach every installed app in seconds and are rarely guarded as tightly as payment systems. Whoever holds the sending credentials holds a trusted channel to the entire customer base.

Impersonating a trusted contact defeats training that tells staff to distrust strangers, because the request appears to come from someone they already deal with.

What could happen next?
  • Risk

    Scammers holding real names and contact details can send phishing that reads as genuine ASOS correspondence for months.

    Short term · Assessed
  • Consequence

    UK retailers are likely to review who holds sending rights on their app notification platforms.

    Short term · Suggested
  • Precedent

    The NCSC issuing a consumer alert naming a single retailer sets an expectation for similar alerts after future UK breaches.

    Medium term · Suggested
Sources:NCSC·City AM
Mentions:ASOS →NCSC →Snowflake →City AM →Telegram →Mandiant →Microsoft →Xuanye Group →Information Commissioner's Office →United Kingdom →Twilio →
First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

NCSC· 12 Oct 2026
Read original →
Causes and effects
This Event
ASOS app pushes rogue alert to customers
A rogue alert inside a trusted shopping app gives fraudsters a more convincing follow-up channel than email.
Led to
Foschini Group attack hits TFG London
TFG's attack on British fashion brands came five days after ASOS's rogue app alert.
Occurred 13 Oct 2026
Read story →
Different Perspectives
Hospital Sírio-Libanês
Hospital Sírio-Libanês
Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.
The Foschini Group
The Foschini Group
The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.
FirstVDS
FirstVDS
FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.
ESET
ESET
ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.
JPCERT/CC
JPCERT/CC
JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.
Cyber Security Agency of Singapore
Cyber Security Agency of Singapore
The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.