Asos confirms customer data breach after hackers send rogue app notification

Asos has confirmed that customer data was breached following a public alert from hackers. The attackers used a push notification to claim they had fully compromised the retailer's cloud storage systems.

What happened

According to TechCrunch, the breach came to light when hackers sent a push notification to Asos customers. This rogue message informed recipients that the attackers had "fully compromised" the fashion giant's cloud storage. Instead of a traditional ransom note or private disclosure, the threat actors chose to broadcast the incident directly to the user base through the company's own application channels.

This method of notification suggests that the attackers had gained sufficient access to the company's communication infrastructure to bypass standard authentication or approval workflows. The notification served as both a warning and a confirmation of the breach, forcing Asos to address the incident publicly. The retailer subsequently confirmed that customer data was indeed affected by the intrusion. The specific nature of the data accessed or the extent of the compromise was not detailed in the initial reports, but the confirmation validates the hackers' claims of access.

Why it matters

This incident highlights a significant escalation in how threat actors communicate breaches. By using push notifications, attackers can bypass media cycles and directly impact customer trust. This approach demonstrates that compromising cloud storage often includes access to customer-facing communication tools. For security operations teams, this underscores the importance of monitoring outbound communication channels for anomalies.

A rogue push notification is a clear indicator of lateral movement within an organization's digital infrastructure. It also raises concerns about the integrity of mobile applications as trusted sources of information. Users may assume that notifications from a known app are legitimate, making this vector particularly effective for social engineering or panic-inducing tactics. The breach confirms that cloud storage vulnerabilities can have immediate and visible impacts on brand reputation.

Our take on the response

• Monitor all outbound communication channels for unauthorized messages.
• Implement strict approval workflows for push notifications and alerts.
• Assume that cloud storage compromise may include access to customer-facing tools.
• Prepare incident response plans that account for public-facing breach announcements.
• Verify the integrity of application servers that handle user notifications.

Background: Social engineering

Social engineering is the psychological manipulation of people into performing actions or divulging confidential information. It relies on trust, urgency, and authority to bypass security controls. Defenses require verifying identity through out-of-band channels and validating requests against established procedures.

Read the full guide: Social Engineering Explained: How Manipulation Bypasses Security

What to do and how to stay safe: Asos

• Phishing-resistant methods prevent credential theft even when users are deceived.
• Conditional access reduces friction by applying stricter checks only during risky events.
• Service accounts require specific handling since they cannot interact with standard authenticators.

MFA is a critical control, but its effectiveness depends on the method used and how it is managed. Prioritize phishing-resistant methods and monitor for anomalies to maintain a strong security posture.

Step-by-step guide: Multi-Factor Authentication Best Practices for Secure Access

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How did hackers notify Asos customers about the breach?

Hackers sent a push notification through the Asos app claiming they had fully compromised the company's cloud storage.

Did Asos confirm that customer data was breached?

Yes, Asos confirmed the breach of customer data after the hackers issued the public alert via push notification.

What did the hackers claim they compromised?

The hackers claimed in their notification that they had fully compromised Asos's cloud storage infrastructure.