ASOS customers woke up on Tuesday to a startling push notification — apparently sent by hackers who have compromised the fashion retailer's systems. The message, addressed to ASOS's data protection officer and IT team, claimed the attackers had "fully compromised the Snowflake instance" and threatened to leak the data unless the company engaged. App users in Australia, France, Sweden and Ireland received it too.
A group calling itself Xuanye Group took credit, linking to a freshly created Telegram channel. Dan Bird of security firm Horizon3 pointed out that sending a push notification needs access to ASOS's notification system, which is separate from Snowflake — so if both claims hold up, the attackers had credentials opening more than one door.
Snowflake says its own investigation has so far found no compromise of its platform. ASOS confirmed the unauthorised notification on Tuesday afternoon, said it immediately restricted access to the notification platforms, and told customers some basic personal information may have been accessed — but not payment cards or account passwords.
ASOS shares fell around a tenth on Tuesday. The company has not yet reported a breach to the UK's Information Commissioner's Office, and the National Cyber Security Centre has offered assistance. How many customers received the notification is still unclear.
Source: BBC News
