Many people woke up on the 6th of October 2026 to a bizarre push notification from Asos, the online shopping platform. The notification linked to a Telegram channel, where the hacker group claimed:
'To clear any confusion, the affected organisations app is safe to use. The incident involves customer information, it is safe on our server, and it will not be touched for a designated period. Considering the current situation regarding incident disclosure in the cyber security landscape, you can thank us for our generous clarity regarding this incident.'
Over 17 million users, across 50 countries, use Asos daily for their shopping. The scale of the breach is not yet clear; however, Asos has communicated that there was unauthorised access on the third-party platforms Asos uses. They claimed that basic personal information including name and contact details may have been accessed.
The group responsible for the breach 'could turn it into convincing scams for months to come,' said Gavin Millard, vice president of product at security firm Tenable. This breach comes at a risky time for retailers such as Asos, as Black Friday is soon approaching. If customers are understandably hesitant to trust push modifications, the business sales will drop.
The strategy from the hacker group goes beyond just targeting business, though, as releasing a push notification to all consumers creates a much more unsettling mental dilemma. 'The most important thing right now is not to panic. At times like this, panic can make matters much worse,” said Pete Membrey, chief research officer at ExpressVPN.
