ASOS App Push Used to Send Hack Claim

How the attack worked

Customers of ASOS received a push notification delivered through the retailer's own official mobile app, a channel they already trusted. The message claimed that ASOS's Snowflake environment had been compromised and directed recipients to engage with the sender through Telegram. ASOS later confirmed to media that an unauthorized customer notification had been sent and said it was investigating activity involving third-party platforms used to communicate with customers.

The pretext relied on urgency and brand trust: a legitimate app notification telling customers to move the conversation to an unrelated chat platform to resolve a supposed security issue. This is a red flag pattern defenders should recognize, since legitimate support processes rarely ask customers to switch to apps like Telegram.

Why it succeeded

Most security awareness advice assumes there will be something suspicious for a recipient to notice, such as a spoofed sender address or an unfamiliar domain. Those checks become far less useful when the message arrives through the genuine app already sitting on someone's phone. Because the notification channel itself was authentic, customers had little reason to question its legitimacy before being redirected elsewhere.

This incident also illustrates a broader risk: a legitimate account, integration, or SaaS platform used in an unexpected way can provide access to attackers while generating activity that looks relatively ordinary when viewed on its own. ASOS said the activity involved third-party platforms used for customer communications, which can make misuse harder to distinguish from normal business operations.

What to watch for

• A trusted brand notification that redirects you to an unrelated chat app to resolve a security issue
• Urgent breach language without the normal in-app support steps
• Requests to communicate outside official, known support channels
• Follow-on messages referencing the original incident, such as fake refund offers, password reset prompts, or account security checks

Building resistance

Organizations and individuals can reduce exposure by treating the authenticity of a channel as separate from the legitimacy of its content. Even a message arriving through a verified app should be checked against official support pages or known contact methods before any action is taken, especially one that proposes moving the conversation elsewhere.

Teams managing third-party customer-communication tools should review permissions, integrations, and authentication controls regularly, since misuse of these platforms may not stand out from routine activity. Security awareness programs should also prepare stakeholders for a second wave of risk: once a real incident becomes public, a phishing email or text offering an account update, refund, password reset, or security check immediately has a credible event behind it, making it more convincing than typical phishing attempts.

What happened in the ASOS push notification incident?

ASOS customers received an unauthorized push notification through the company's own app claiming its Snowflake environment had been compromised and directing recipients to engage with the sender via Telegram.

Was ASOS customer data compromised?

ASOS said names and contact details may have been accessed, but passwords and payment cards were not believed to be affected, and it was investigating activity involving third-party customer-communication platforms.

Did Snowflake confirm a breach?

Snowflake stated it had not found evidence of a Snowflake platform compromise at the time.

Why is this incident concerning beyond the initial notification?

The incident could enable follow-on scams, such as emails or texts referencing the real event to appear more credible, including fake refund, password reset, or security check requests.