Push message claims fashion company’s data has been ‘fully compromised’, but website and app remain online