Cyber Bites - 9th October 2026

We'll start with Aesop.

The retailer is investigating unauthorized access to its app notification infrastructure after customers received push notifications on 6th of October claiming the company had been fully compromised.

The messages directed recipients to a telegram channel operated by a previously unknown group that is calling itself the Shuang Yi group.

Aesop said basic personal information, including names and contact details, may have been accessed by an unidentified third party, but it did not believe card payment records or passwords had been compromised.

The company restricted access to the affected notification platforms.

They apologized to customers and advised them to ignore the message and avoid links.

The website and app continued operating normally, although the incident still had a clear commercial impact.

their shares fell more than 14% during the day before closing 9.56% lower.

The notification was addressed to the Aesop data protection officer and IT department and claimed that the company's snowflake instance had been fully compromised.

Whether that claim is accurate remains unclear.

And Aesop said it was too early to quantify the impact on trading.

The immediate lesson is that customer communication systems need the same level of protection and monitoring as core production services.

If an attacker can control a trusted notification channel, they can create a convincing message without needing to compromise every customer individually.

There is also a predicted second phase to incidents like this.

Once a breach or extortion attempt becomes public, other attackers can use the publicity to impersonate the affected organization.

Customers may receive messages about password resets, payment confirmations, or order checks, even when the original incident did not expose passwords or payment details.

In this case, Aesop's customers should treat unexpected requests linked to the incident with caution and use the organization's normal website or app rather than the links delivered through email, text messages, or social media.

For organizations, the response is broader than simply disabling a compromised notification platform.

It includes validating the scope of data access, securing administrative accounts, reviewing integration paths into cloud platforms, and preparing a clear customer communication process.

The reputational effect can arrive before the technical investigation is complete, which makes accurate, timely messaging an important part of incident response rather than an afterthought.

We'll start with Aesop.

The retailer is investigating unauthorized access to its app notification infrastructure after customers received push notifications on 6th of October claiming the company had been fully compromised.

The messages directed recipients to a telegram channel operated by a previously unknown group that is calling itself the Shuang Yi group.

Aesop said basic personal information, including names and contact details, may have been accessed by an unidentified third party, but it did not believe card payment records or passwords had been compromised.

The company restricted access to the affected notification platforms.

They apologized to customers and advised them to ignore the message and avoid links.

The website and app continued operating normally, although the incident still had a clear commercial impact.

their shares fell more than 14% during the day before closing 9.56% lower.

The notification was addressed to the Aesop data protection officer and IT department and claimed that the company's snowflake instance had been fully compromised.

Whether that claim is accurate remains unclear.

And Aesop said it was too early to quantify the impact on trading.

The immediate lesson is that customer communication systems need the same level of protection and monitoring as core production services.

If an attacker can control a trusted notification channel, they can create a convincing message without needing to compromise every customer individually.

There is also a predicted second phase to incidents like this.

Once a breach or extortion attempt becomes public, other attackers can use the publicity to impersonate the affected organization.

Customers may receive messages about password resets, payment confirmations, or order checks, even when the original incident did not expose passwords or payment details.

In this case, Aesop's customers should treat unexpected requests linked to the incident with caution and use the organization's normal website or app rather than the links delivered through email, text messages, or social media.

For organizations, the response is broader than simply disabling a compromised notification platform.

It includes validating the scope of data access, securing administrative accounts, reviewing integration paths into cloud platforms, and preparing a clear customer communication process.

The reputational effect can arrive before the technical investigation is complete, which makes accurate, timely messaging an important part of incident response rather than an afterthought.