UK online fashion giant Asos said Tuesday it was investigating “unauthorised activity involving third-party platforms” after its customers received a phone alert saying the retailer had been hacked.

Asos, which has 17 million active customers worldwide, said personal information like names and contact details “may have been accessed” but that it did not believe payment card information or account passwords were impacted.

The company noted its website and app were operating normally following the incident.

“We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers,” Asos said in a statement.

“We took immediate action to restrict access to the notification platforms and are working with our internal and external specialist advisers, as well as all relevant authorities.”

Customers had received a mobile app notification titled “Asos hacked” and directing them to a Telegram account.

“Dear Asos DPO and IT, we have fully compromised your Snowflake instance. Engage with us, or we will leak it,” read the notification, according to screenshots shared on social media and reported by British media.

DPO stands for data protection officer, while Snowflake is a US company that provides its clients with a cloud-based platform for data storage, management and analysis.

In a statement shared with AFP, a Snowflake spokesperson said the firm began an investigation as soon as it became aware of the reported notification.

“At this time, we can report that we have found no compromise of the Snowflake platform,” the statement added.

“We take customer privacy and security very seriously. The investigation is ongoing and we will provide further updates as soon as more information becomes available.”

This kind of notification, which amounts to “psychological warfare”, is “designed to whip up panic”, said Marie Wilcox, market strategy analyst at cybersecurity firm Binalyze.

The attackers reasoned that “any panic piles on the pressure on Asos to think about paying up rather than taking time to develop a rational response,” she said.

Britain’s state-run National Cyber Security Centre (NCSC) has offered Asos assistance, according to sources.

A spokesperson for the country’s data watchdog, the Information Commission Office, said it did not appear “to have received a report on this matter at this stage”.

Asos told shareholders it has cyber security insurance with a large provider and that it was “too early” to quantify any potential impact on its trading, Britain’s Press Association news agency reported.

Join the community of 2M+ industry professionals.

Subscribe to Newsletter to get latest insights & analysis in your inbox.

All about ETCISO industry right on your smartphone!