Shares of Asos, the London-based online fashion retailer, fell more than 13% on Tuesday after customers received alarming push notifications through the company's app, allegedly from hackers claiming to have compromised its Snowflake cloud environment. The messages, which appeared to be sent by a group calling itself the Xuanye group, demanded engagement or threatened to leak data.
The notification, addressed to Asos' data protection officer and IT department, read: "we have fully compromised the Snowflake instance. Engage with us, or we will leak it." Dozens of users took to social media to express confusion about the message's meaning and why it was delivered directly through the retailer's app. The website and app continued to operate normally on Tuesday morning, while Asos said it was investigating whether a cyberattack had actually occurred.
Security Experts Urge Caution
Cybersecurity researchers noted that the Xuanye group had not been previously known, raising the possibility that the notification could be an attempt to attract attention or establish credibility. "It's not unusual to see new groups emerge, and often they wait until they have what they see as a significant opportunity before they announce themselves so as to enter the ecosystem with 'credibility'," said Aiden Sinnot, principal threat researcher at Sophos.
Experts warned against assuming a breach based solely on the attackers' message. Tatyana Shishkova, lead security researcher at Kaspersky, said organisations needed to establish which systems had been accessed, what information may have been exposed, and how attackers gained entry through a forensic investigation. "The ability of hackers to directly contact potential victims through push notifications in the Asos app highlights how disruptive cyber incidents can be when threat actors gain access to trusted communication channels," she added.
Snowflake Connection Raises Concerns
The reference to Snowflake, a major cloud data platform used by retailers to store sensitive customer information such as transaction details and body measurements, has heightened concerns. Snowflake shares were down 0.4% in premarket trading. The company has faced scrutiny over data breaches involving customers in recent years, including an attack on Ticketmaster where customer information was reportedly stolen.
However, security experts cautioned that the claims made through the Asos notification should not be treated as confirmation that the retailer's Snowflake environment had been compromised. Dray Agha, senior manager of security operations at Huntress, noted that "Snowflake is a massive cloud database where retailers typically store sensitive customer information, a real worry if cyber criminals have indeed accessed it as they claim."
UK Companies Face Growing Cyber Threats
The incident comes amid a series of high-profile cyberattacks affecting British businesses and institutions, including the British Library, a blood-testing service, the London Underground, Marks & Spencer, Co-op, and Jaguar Land Rover. Shishkova said the Asos episode also demonstrated the importance of robust identity and access controls across cloud environments. Recent Kaspersky investigations have found that cybercriminals increasingly exploit misconfigurations, exposed services, and legitimate tools already available within organisations rather than relying exclusively on sophisticated malware.
For Asos, the immediate question remains whether the notification represents a genuine compromise of company systems or an attempt to create panic around an unverified claim. The retailer, which owns brands including Topshop and Miss Selfridge, has 17 million customers across more than 150 countries and employs about 2,800 people. The UK is its largest market, accounting for 49% of group revenue in its first-half results. Despite Tuesday's decline, its stock is up over 50% year-to-date.
This article is for informational purposes only and does not constitute financial advice.
