The ASOS Hack: Why push notifications should be treated as critical infrastructure

While ASOS is left assessing the damage, the question for everybody else is; how easy would it be for someone to send a message to your customers, impersonating your brand? How fast could you stop them? And what could the full extent of the damage really be?

What happened?

[As of Oct 13th]

At around 10am on 6 October 2026, a push notification went to ASOS app users, addressed to the company’s data protection officer and IT team. It claimed ASOS’s data had been compromised, threatened a leak and linked to a Telegram channel.

ASOS says an attacker impersonated a trusted contact to obtain an employee’s login credentials, then used them to access third-party platforms the company uses to communicate with customers. It has restricted access to those platforms and brought in external experts and the authorities. ASOS has confirmed names and contact details were accessed, and a data sample seen by the BBC suggests more, including addresses, phone numbers and customer numbers. ASOS says no payment card information or passwords were accessed.

A previously unknown group calling itself Xuanye says it holds the data and claims to have compromised a Snowflake instance. Snowflake says the incident did not result from any vulnerability, flaw or misconfiguration in its service.
We still don’t know which platform sent the message, how many customers are affected, or whether multi-factor authentication was in place.

What we do know is how far it reached. 90% of the people we spoke to to further understand the impact of the hack, shop with ASOS, and 20% of them received the notification themselves.

Push is a trusted channel

Most organisations think of push purely as a marketing channel. Customers see it differently; to them, a push notification is a trusted message, directly from the brand. When we asked which channel they trust most from companies, 60% of our respondents chose push notifications. The other 40% chose email, and nobody picked text messages or social media. On a scale of 1 to 5, push averaged 4.0 for trust, ahead of email on 3.85, and nobody rated it below 3. 

Years of phishing warnings taught people to be sceptical of links in emails and texts, but push notifications haven’t received the same level of scrutiny. Our respondents said as much. Push felt “harder to falsify”, whereas “emails and texts can be made to look like legitimate sources”. One put it simply: “I have chosen to install the app, so I know that the communications received are legitimate.” Another thought there was “less chance of a third party being able to interfere” – which is exactly the assumption the ASOS attacker relied on.

Even those who preferred email made the point for us. They liked that “it’s easy to see where it’s from and I can check it”. A push notification offers no such check; it arrives with the brand’s name and icon, and that’s all the verification a customer gets.

That’s what makes it such a valuable channel for brands, and such a high value target for attackers. Push notifications are more than a campaign tool; they’re critical infrastructure.

The push permission is incredibly hard to win and very easy to lose; around half of iOS retail users opt in, and opted-in customers buy about 13% more than those who don’t. Do you know your opt-in rate, and what that’s worth to your business?

What’s the damage?

The ASOS message didn’t need to steal anything to do damage. “ASOS HACKED” arrived, the effect was immediate, and there was nowhere to hide. The story instantly ran across national news and share price fell more than 10% the same day; none of which depended on whether any data had actually been taken.

The hit to customer trust was just as quick. When we showed people the notification, their trust in the retailer behind it dropped to an average of 2.7 out of 5. “It makes their security look bad,” one said. “Makes them less trustworthy in the future.” Another went further: “I would feel every notification could be a hack to get me to use a compromised app.” For a permission that’s so hard to win back, that’s a real cost.

Interestingly, the respondents who actually received the notification all still rated push notifications 3 or 4 out of 5. The channel kept their trust; the brand took the hit. That’s good news for push, and exactly why it remains such an attractive target.

Could it have been worse? The message was unmistakably a hack, but imagine the same access used to send “50% off”, linking out to a convincing sign in page, arriving from a channel customers trust – few would stop to question it. Some respondents told us they’d now be “more wary of notifications that seemed too good to be true”, but “would still trust notifications that seemed legitimate”. A legitimate-looking message is exactly what a careful attacker would send.

The question isn’t whether ASOS got something wrong; assuming this was some sort of social engineering attack, that can happen to anyone. The question is whether the same thing could happen to your mobile product, and what procedures you have in place should the worst happen.

What can be done to protect your product, and customers?

There’s four areas that need attention, and these apply across various industries.

Push rarely has a kill switch
Most apps have established kill switches: remote flags that disable a feature or change its behaviour without a new release, typically in response to a major defect or outage to protect user experience. What we see is very few apps have a kill switch for push.

Control on the app is limited. Once a notification is sent, the phone’s operating system displays it without the app getting a say. An effective kill switch needs to sit with the platform, however with many third-party services set up to communicate directly with Apple & Google’s services, implementation of this could be anything but straight forward.

App as the last line of protection
You may not be able to stop a rogue push notification from being seen, but you are in control of what happens when it’s opened. The app holds the keys to where a push notification can take a user.

The ASOS message landed customers on a Telegram channel. Whether that could happen in your app is something you can check today.

How many platforms can send push notifications to your customers?
We regularly see multiple platforms capable of sending a push within one estate. Each one brings its own overhead and increases the attack surface. It’s also not uncommon for these things to get replaced, and all it takes is a busy roadmap for an old push certificate or SDK to be left lying dormant with keys still active.

Enterprise platforms can help with guardrails
None of this is an argument against engagement platforms. Quite the opposite, enterprise platforms offer controls such as approval workflows, send restrictions and role-based permissions that a custom rolled pipeline is unlikely to have. That’s a reason to use one, and to make sure those controls are switched on.

What customers expect from a brand after a rogue message

The good news is that customers are forgiving, up to a point. Trust took a knock in our research, but it didn’t disappear: “Trust wouldn’t go completely but I’d definitely be less keen on using them in future.” Others pointed out that “emails and company websites have been hacked before”, and that a single incident doesn’t make push notifications bad.

What comes next is what counts. Again and again, people told us their trust hinges on the response, not the incident: “All depends on how the company reacts and updates customers.” Or, more bluntly: “Mistakes can happen it’s about what happens afterwards.”

That patience has limits. One respondent would “still trust them unless it keeps happening frequently”, while another said they’d be “confused from the previous notification and definitely not be as inclined to trust further notifications”. Silence leaves that confusion to fill itself, a clear, fast follow-up is how you close the gap.

Three questions you should be asking

More detail on the ASOS incident will come out in due course, but you don’t have to wait for the report. Here’s three questions you can ask today:

Who can send a message as your brand?

• Every platform that can push to your customers, including any you’ve recently retired.
• Every person, agency and API key with send access, and whether multi-factor authentication is enforced.
• Can one person send to your whole customer base without a second approval?

How fast could you act?

• Is there a kill switch for push?
• Who can pull the plug?
• How would you follow up the message?

Where can a tap send your customers?

• Will your app open any link a notification carries, or only to your controlled domains?

This is worth every brand exploring now to best protect themselves from a similar and equally reputational-damaging situation.