ASOS users receive fake hack alert, shares tumble as investigation begins

What triggered the ASOS app notification

In early March, a sudden surge of push notifications appeared on the ASOS mobile application. The alert carried a bold headline that read “ASOS hacked” and warned that the company’s data had been fully compromised. A link within the message redirected users to the Telegram messaging platform where further details were purportedly posted.

The notification was not generated by ASOS itself. Users reported that the message arrived as a standard app alert, identical in appearance to official communications, yet the content and the external link raised immediate suspicion.

How the false alert reached consumers

Security analysts suggest that the message was likely the result of a malicious advertising campaign or a compromised third‑party service that delivers push notifications. The exact vector remains under investigation, but several possibilities have emerged:

• Insertion of malicious code into an advertising SDK used by the app.
• Exploitation of a misconfigured server that handles push delivery.
• Social engineering that convinced a small number of users to share the alert, amplifying its reach.

Because the push appeared within the official app, many users assumed it was authentic, clicking the link and exposing themselves to potential phishing or malware on Telegram.

ASOS response and official statements

Within hours of the reports, ASOS issued a public statement on its corporate website. The company confirmed that its platforms – the website and mobile app – remained fully operational and that no evidence of a data breach had been found. ASOS also reassured customers that their personal information was safe and that the notification was not sent by the retailer.

The statement quoted the company’s Chief Information Security Officer, who said, “We are working with our security partners and relevant authorities to identify the source of the unauthorized push messages. Our priority is to protect our customers and maintain trust.”

ASOS advised users to delete the Telegram link, avoid sharing personal details, and to report any suspicious activity to the company’s support team.

Market reaction and share price impact

Investors reacted swiftly. Within the trading day, ASOS shares on the London Stock Exchange fell nearly twelve percent, wiping out a significant portion of the company’s market capitalisation. Analysts at major brokerages highlighted the incident as a reminder of the reputational risk associated with cyber threats, even when no actual breach occurs.

Financial news outlets such as BBC News reported that the drop was one of the steepest for a UK‑listed retailer in recent months. The volatility also sparked discussions about the need for stronger communication protocols around security alerts.

Insights from cybersecurity experts

Several experts weighed in on the episode. A senior analyst at a leading security firm explained that push notification abuse is an emerging vector because it bypasses many traditional email filters and can appear highly credible.

Key points from the expert commentary include:

1. Push messages are delivered through trusted channels, making users less likely to question their legitimacy.
2. Attackers often embed links to messaging apps like Telegram because they are less regulated and can host rapid updates.
3. Companies should implement cryptographic signing of all push payloads and display a clear source identifier within the app.

The analyst also referenced guidance from the National Cyber Security Centre, which advises organisations to treat push notifications as a potential attack surface and to monitor for anomalies.

Practical steps for ASOS customers

While the incident appears to be a false alarm, customers can take several actions to protect themselves:

• Do not click on unexpected links, especially those that redirect to messaging platforms.
• Verify any security‑related alerts by visiting the official ASOS website or contacting support directly.
• Enable two‑factor authentication on the ASOS account to add an extra layer of security.
• Monitor bank statements and credit reports for any unusual activity.
• Report suspicious messages to the UK Information Commissioner if personal data may have been exposed.

Broader implications for online retail security

The ASOS episode underscores a growing challenge for e‑commerce platforms. As mobile usage expands, push notifications become a powerful tool for engagement, but they also present a new attack vector. Retailers must balance the need for timely communication with rigorous verification processes.

Industry bodies such as the ISO/IEC 27001 standard provide frameworks for managing information security risks, including the handling of mobile messaging. Adoption of these standards can help firms detect and mitigate unauthorized push campaigns before they reach end users.

In the weeks ahead, ASOS is expected to publish a detailed post‑mortem of the incident, outlining technical findings and steps taken to harden its notification infrastructure. The outcome will likely influence best practices across the sector, prompting other retailers to review their own push delivery mechanisms.

For consumers, the episode serves as a reminder to stay vigilant, question unexpected alerts, and rely on official channels for verification. In a digital landscape where threats evolve rapidly, a cautious approach remains the most effective defence.