ASOS Data Breach: Hackers Turn Retailer’s Own App Into a Ransom Note

ASOS customers reported receiving app push notifications from an extortion group (self-identified as "Xuanye Group") claiming to have compromised ASOS’s Snowflake instance and threatening a data leak; the claim remains unverified as no sample data or proof has been published. The notifications included a link to a Telegram channel created the same day; security commentary suggests the incident could indicate stolen/reused credentials, exposed API keys, or compromised push-service tokens. Recommended actions include rotating credentials and tokens, enforcing MFA and network policies, reviewing audit logs and notification-sending permissions, and preparing customer/regulator communications if a breach is confirmed.