ASOS investigates after hackers use its app to threaten a Snowflake data leak
ASOS is investigating after customers received an app notification claiming hackers had compromised its Snowflake data and would leak it unless the company engaged. The retailer has not confirmed a breach or what, if anything, was accessed; the notification’s appearance through ASOS’s own app raises concern about access to its systems, while its shares fell more than 14% at one point, according to the Guardian.
Bottom line — ASOS has yet to confirm a breach, and the scope of any customer-data exposure remains unknown.
Go deeper 7
-
The message linked to a Telegram channel for a group calling itself Xuanye; the Guardian reported cybersecurity researchers had not heard of the group before.
-
The Standard reported that the group later claimed payment information was unaffected, but the claim has not been independently verified.
-
Horizon3’s Dan Bird said sending the notification would require access to ASOS’s app notification system, separate from the Snowflake platform the attackers claim to have compromised.
-
ASOS has not said whether it uses Snowflake directly or what data, if any, was stored there, according to the BBC.
-
Malwarebytes researcher Pieter Arntz told TechRadar Pro that ASOS’s marketing system Simon AI runs on Snowflake, but said that connection does not establish what attackers could access.
-
The Guardian reported ASOS’s website and app appeared to remain operational while the company investigated.
-
The Independent reported that customers should be wary of unexpected messages asking them to reset passwords, confirm payment details or claim refunds.