ASOS shares drop up to 13% after app users receive extortion push alerts

Unauthorized push alerts

Customers using the ASOS mobile application across the United Kingdom, Italy, the Netherlands, and other international markets received unexpected push notifications on Tuesday morning. The alerts arrived directly on user smartphones, prompting confusion across social media where shoppers began posting screenshots of the incoming text. Rather than targeting consumers with promotional content, the notification was explicitly addressed to the retailer's Data Protection Officer and internal information technology department. The text stated that attackers had gained control over corporate systems and urged company staff to enter negotiations, providing an external link directing recipients to a Telegram chat channel. Down Detector registered a noticeable increase in user problem reports regarding the ASOS app starting just before 10:00 on Tuesday morning. Despite the app alerts, the retailer's e-commerce website remained operational throughout the morning hours.

Snowflake infrastructure and extortion demands

The notification sent to customer phones asserted that attackers had accessed the retailer's dedicated environment on Snowflake, a software-as-a-service cloud platform. Companies utilize Snowflake accounts to store, process, and analyze massive volumes of commercial and consumer data within a centralized architecture. The message threatened that customer data would be published publicly online if ASOS management did not communicate with the perpetrators. Computer forensics expert Paolo Dal Checco outlined how these enterprise cloud repositories function for digital storefronts.

A Snowflake instance can be described as a cloud-hosted computing environment used by a company to store and manage large amounts of data, often belonging to users who benefit from a service such as e-commerce.

Dal Checco explained that Snowflake environments centralize information from distinct systems, managing permissions for account logins, product orders, payments, returns, and customer service requests. Unauthorized access to such an environment allows external parties to extract and duplicate stored files outside company infrastructure. Cloud security across Snowflake accounts has faced scrutiny following previous data breaches that affected other multinational corporations, including Ticketmaster and Santander.

Regulatory obligations and corporate scale

ASOS operates one of the largest fashion platforms in Europe, serving approximately 17 million active customers across 150 countries from its corporate headquarters in the United Kingdom. The platform records an annual customer reach of roughly 16 million shoppers across its European and international territories. Under United Kingdom data privacy legislation, ASOS is legally required to report a security incident to the Information Commissioner's Office within three days. The law further obligates organizations to directly inform impacted customers whenever an unauthorized data exposure is classified as high risk. In response to initial press inquiries on Tuesday, an ASOS spokesperson stated that the company was aware of the user reports but did not confirm a breach or provide technical commentary.

Market reaction and share price drop

The security notifications triggered a swift negative reaction among equity investors in London on Tuesday. ASOS shares dropped by more than 11% during morning trading and reached an intraday decline of as much as 13%. The 13% drop marked the retailer's steepest single-day intraday share slump since September 2025. The sell-off reflected investor concerns regarding potential regulatory penalties, customer remediation costs, and operational disruption if the extortion threats materialize.