On Tuesday morning, Asos users in the UK received unauthorized push notifications via the app’s messaging system, which appeared to be from hackers demanding contact and threatening data leaks. The company responded by taking immediate action to restrict access and is investigating with external experts and authorities. While the extent of compromised information remains unclear, Asos assured customers that payment-card information and account passwords are believed safe from impact. Users are advised not to click on any links in these messages and to update their passwords across multiple sites for enhanced security.
Written locally by qwen2.5:14b on 2026-10-06,
using this article's own text rather than the other coverage of the
same event (that is the story summary below).
- Published
If a strange-looking message from Asos popped up on your phone today, you may be worrying what it could mean and whether you need to do anything.
uncertain
you → publish → anything
The online retailer has emailed customers apologising for the "unauthorised push notification" containing an external link, adding that they should disregard the message and not click on it.
asserted
they → email → it
Here's what has happened, and what those who may have been affected are being advised to do.
uncertain
who → happen → what
What message did people receive?
asserted
people → receive → message
On Tuesday morning, Asos users across the UK were sent pop-up messages from its app that appear to have been sent by hackers trying to extort the company.
asserted
that → send → company
"Dear ASOS DPO and IT, we have fully compromised the Snowflake instance.
asserted
we → compromise → instance
Engage with us, or we will leak it
asserted
we → engage → it
," the message read.
asserted
message → read → ?
Later that day, Asos said it took immediate action to restrict the apparent hackers' access, was investigating and working with advisers and relevant authorities on "next steps".
asserted
it → say → steps
Data storage company Snowflake told the BBC its investigations had "found no compromise" of its platform.
asserted
investigations → tell → platform
What does this mean for my data?
asserted
this → mean → data
At this stage it isn't clear what information, if any, has been accessed.
asserted
information → access → stage
On Tuesday evening, Asos told customers it may include "basic personal information including name and contact details".
"However, we don't believe that any payment-card information or account passwords have been impacted," it added.
uncertain
it → tell → name
While those who received the pop-up message will undoubtedly be concerned, it does not mean your phone has been hacked.
asserted
phone → receive → message
What can I do to protect myself?
asserted
I → do → myself
For now, the advice is:
Don't click the link:
asserted
advice → click → link
The hack notification included a link to a Telegram account - Asos and cyber security experts say not to click on it
Change passwords:
asserted
Asos → include → passwords
It's worth updating your password, including across other sites that use the same one as your Asos account.
asserted
that → update → account
The advice for a strong password is to mix numbers, symbols and upper and lower case characters, and avoid using the same password across multiple accounts
Turn on two-step verification for important apps like banking and email:
asserted
advice → mix → banking
The National Cyber Security Centre (NCSC) calls this "one of the most effective ways to protect your online accounts from cyber criminals".
asserted
Centre → call → criminals
You can usually turn it on by going into the security settings in your account
Monitor transactions: Keep an eye on your online transactions for anything unusual
Be alert going forward
According to Charlotte Wilson, head of enterprise at global cyber-security firm Check Point, "the biggest immediate risk may be what happens next".
uncertain
what → turn → Point
She says criminals know people will be searching for information online and expects there to be "attempts to exploit that confusion".
asserted
people → say → confusion
But she says they should be "extremely suspicious" of emails, texts or messages claiming their account has been compromised, offering a refund or asking them to click a link to reset their password.
asserted
account → say → password
People should hang up the phone if they receive any calls from someone they think might be posing as Asos or another organisation, says Which? spokesperson Kat Cereda.
uncertain
Cereda → hang → Asos
The consumer rights expert says they should contact the organisation themselves afterwards through separate means.
asserted
they → say → means
'An awful lot' we don't know
asserted
we → know → lot
It's been less than 24 hours since the notification popped up on people's phones, and there are a number of unanswered questions.
asserted
notification → pop → questions
It isn't yet clear who is behind the message, what their motivation is, how many people received the notification or how many may be impacted
Wilson, from the cyber-security firm Check Point, says there's still "an awful lot" we don't know.
uncertain
we → receive → firm
Asos said its website and app were operating "as normal, and customers can continue to shop with confidence on ASOS as normal" as of Tuesday night.
asserted
customers → say → night
It said protecting customers "is our priority", and it will provide a further update "as soon as we have confirmed more information".
asserted
we → say → information
People should visit Asos's official website directly for updates.
asserted
People → visit → updates
The Aporia
