Asos Investigates Major Data Breach After Hackers Send Brazen Extortion Alerts

Online fast-fashion giant Asos is grappling with a major cybersecurity breach after hackers gained unauthorized access to third-party communication systems and broadcast extortion threats directly to shoppers' phones. Customers received notifications claiming that their detailed personal profiles had been harvested and threatening public leaks unless the company paid a ransom. Following the unauthorized alert, Asos confirmed that basic customer contact information may have been accessed, though it stated there is currently no evidence that payment card credentials or account passwords were compromised.

The extortion group, identifying as the 'Xuanye Group' on Telegram, alleged it had compromised the retailer's Snowflake cloud data platform and set a two-week deadline for engagement. The hackers claimed to possess extensive records, including names, home addresses, phone numbers, and site search histories. While Asos's shares dropped over 9% following the disclosure, Snowflake disputed claims of a system-wide breach, stating, 'At this time, we can report that we have found no compromise of the Snowflake platform.' Cybersecurity experts characterized the direct push notifications as tactical psychological warfare designed to pressure executives by inciting public panic.

The breach hits the British retailer during a critical restructuring drive to arrest sliding revenues and restore profitability under pressure from major shareholders, including Mike Ashley's Frasers Group. With roughly 17 million active users worldwide across 150 countries, the UK remains Asos's domestic anchor, representing nearly half of its total turnover. The incident forms part of an escalating wave of cyber operations hitting British enterprises, arriving months after a vendor flaw exposed records across approximately 1,000 UK-based charities.

Asos assured consumers that its mobile application and e-commerce platform remain safe to use, urging users to disregard unsolicited inquiries requesting financial or security credentials. Under United Kingdom data protection statutes, the company faces mandatory compliance rules requiring rapid and transparent disclosure to affected consumers. Ongoing forensic reviews involve both third-party specialists and regulatory authorities, while Asos confirmed it maintains comprehensive corporate cyber insurance to absorb operational fallout.