In a move that cyber security experts are calling "brazen" and "deeply serious," hackers managed to send a push notification to Asos app users on Tuesday morning that read "ASOS HACKED." The message, addressed to the company's data protection officer and IT teams, informed recipients that their Snowflake instance had been "fully compromised" and demanded engagement via a Telegram channel, lest the data be leaked. Because nothing says "we're professionals" like using a clothing app's notification system as a ransom note.

Dozens of customers told the BBC they received the alarming message around 10:00 BST, with some saying it left them "scared" to open the app. Jodie, an analyst from Edinburgh, initially thought it was a quirky promotion: "At first I thought it was an ad or a fun promotion like 'ASOS HACKED get 50% off everything for a limited time only,'" she said. "Then I read the rest of the message which clearly showed that it wasn't an ad and instead a message to IT." Erin, a student at the University of Sheffield, expressed concern about her bank information, home address, and telephone number being compromised, and questioned the extent of the breach: "Are all customers affected even if they didn't get the notification? It's poor from Asos on all fronts."

Asos acknowledged the "unauthorised customer notification" on Tuesday afternoon, stating it was investigating "unauthorised activity" involving third-party platforms. The company said some "basic personal information" may have been accessed, but it does not believe payment-card information or account passwords were impacted. In an email to customers on Tuesday night, Asos apologised and urged them not to engage with the notification, promising that the website and app are "operating as usual" and that customers can "shop with confidence" while the investigation continues. The company has not yet informed the UK's data watchdog, the Information Commissioner's Office (ICO), about any breach.

The exact number of affected customers remains unclear, but with the ASOS app downloaded over 10 million times on Android alone, and the British retailer serving around 17 million customers annually across more than 150 markets, the potential reach is significant. Reports from Australia, France, Sweden, and the Republic of Ireland indicate the notification was not confined to the UK. Shares in the company fell by around a tenth on Tuesday, because nothing says "shop with confidence" like a stock dip.

Charlotte Wilson, head of enterprise at cyber-security firm Check Point, called the attack "deeply serious" and "brazen," noting that the hackers had apparently "turned Asos' own app into their ransom note." She advised customers not to be "scared and frightened," but to change passwords, avoid clicking the notification's link, and be cautious about possible scam emails or texts. The National Cyber Security Centre has offered assistance to Asos.

Snowflake, whose tools are used by dozens of firms to collect, analyse, and store data, told the BBC its investigation is ongoing but has so far found "no compromise" of its platform. However, the company's services have been the subject of many high-profile data breaches in recent years. Cybersecurity expert Jen Ellis noted that Snowflake collects data from multiple sources for analysis, and an "enormous" firm like Asos will have lots of data about how people shop globally. Dan Bird, from cybersecurity firm Horizon3, pointed out that sending a push notification to Asos's app users would require access to the company's notification system, which is separate from the Snowflake data platform the attackers claim to have compromised. "If both claims hold up, it suggests the attackers got hold of credentials that opened more than one door," he said.

The incident may go down as a significant moment in cyber-attack history, as hackers seeking to pile pressure on potential victims by informing their customers is rare - most extortions happen in private. Experts believe the attackers are most likely trying to "apply pressure" to Asos to meet their demands, rather than target its customers. Asos has also shared a statement to the London Stock Exchange's Regulatory News Service, providing updates to investors.

For those who received the notification, it's important to know that it does not mean your phone has been hacked. Do not click on links in the notification, visit Asos's official website directly for updates, and watch out for emails, texts, or calls offering refunds, compensation, or help with your account - scammers will exploit this type of incident when they know people are worried. Try to use different passwords for your online services, enable two-step verification on email and banking accounts, and keep an eye on your online transactions for anything unusual.

Additional reporting by Shiona McCallum, Chris Vallance and Alex Emery.