Asos shares on the London Stock Exchange fell almost 10% after the retailer launched an investigation into a reported data breach. Thousands of customers received a push alert titled “Asos hacked” that directed them to a Telegram channel. The company’s website and mobile app continued to operate on Tuesday morning.

The notification warned that attackers had taken control of a critical cloud platform. “Dear Asos DPO [data protection officer] and IT, we have fully compromised the Snowflake instance.” The platform stores transaction records, customer measurements, and handles app notifications. Experts say Snowflake also holds sensitive personal data that retailers typically keep in large cloud databases.

Security analysts noted that the Telegram group behind the alert, called Xuanye, has no prior record on hacker forums. Researchers suggest the group may be testing the waters to gain credibility in the cybercriminal ecosystem. Dray Agha from Huntress said the alert indicates attackers likely breached the systems that control the mobile app itself.

Cybersecurity leaders warned that the publicity will likely trigger follow-up attacks. Customers should watch for fake emails or texts that mimic official Asos messages. Scammers often use these moments to trick shoppers into resetting passwords or confirming payment details under the guise of issuing refunds.

The incident follows a series of cyber attacks targeting British retailers last year. Marks & Spencer and the Co-op both faced system disruptions, and Marks & Spencer closed its website for several weeks while it cleaned its networks. Harrods also reported security issues during the same period.