ASOS is investigating unauthorized activity involving third‑party platforms after hackers sent a notification to app users.
Numerous customers reported receiving an alarming ‘ASOS HACKED’ notification through the app on Tuesday morning, with some saying it left them afraid to open the app.
The notification was addressed to ASOS’s data protection officer and IT teams and appeared to be a brazen extortion attempt, according to cybersecurity experts.
ASOS acknowledged the unauthorized customer notification later that afternoon, indicating that some basic personal information may have been accessed.
In an email sent to customers that evening, the company apologized, advised them not to interact with the notification, and assured them that the website and app were operating normally, allowing customers to shop with confidence while the investigation continued.
ASOS has not yet notified the UK Information Commissioner’s Office (ICO) of a data breach.
The exact number of customers who received the notification remains unknown, although Google’s Play Store reports that the ASOS app has been downloaded over 10 million times on Android devices.
The retailer serves approximately 17 million customers annually across more than 150 markets, underscoring its extensive global presence.
Users in Australia, France, Sweden, and the Republic of Ireland also received the notification, local reports indicated.
This tactic, which publicly pressures victims rather than conducting private extortion, is uncommon; thus, the incident could become a notable reference point in cyber‑attack history.
The company’s shares dropped by approximately 10% on Tuesday.
Charlotte Wilson, Head of Enterprise at cybersecurity firm Check Point, described the attack as ‘deeply serious’ and ‘brazen’, noting that the hackers had effectively turned ASOS’s own app into a ransom note.
However, she advised customers not to be scared, recommending that they change their passwords, avoid clicking any links in the notification, and remain vigilant against potential phishing emails or texts.