ASOS “hackers” send push notifications to customers
ASOS customers got in-app alerts claiming hackers fully compromised Snowflake and threatening to leak data.
Thousands of ASOS customers received an in-app push notification addressed to the retailer's data protection and IT teams, claiming the company's Snowflake instance was fully compromised and threatening a leak unless ASOS engages. ASOS uses Simon AI, which runs on Snowflake, with Braze to personalize pushes, so abuse of that channel is plausible, but the Snowflake theft is not confirmed. A group calling itself Xuanye said payment data was unaffected, an unverified claim, while an ASOS representative told Sky News the alert was fraudulent and under investigation. There is no verified evidence that customer databases, payment cards, or passwords were stolen.
- Thousands of ASOS app users received a push claiming a full Snowflake compromise.
- Message tells ASOS security staff to engage or the data will be leaked.
- ASOS marketing uses Simon AI on Snowflake and Braze for customer pushes.
- Xuanye group said payments were unaffected; that claim is unverified.
- ASOS support called the alert fraudulent and said it is investigating.
Full article498 words · extracted from malwarebytes.com · click to collapse
Thousands of global fashion retailer ASOS customers have received a push notification through the ASOS app this morning alleging that the company has been hacked.
The notification, addressed to ASOS’s data protection officer and IT, says:
“ASOS HACKED
Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it”
What we know so far
Snowflake is a cloud-based data platform that organizations use to store, process, and analyze data. We know that ASOS’s marketing team uses Simon AI from a blog posted by Simon. Simon AI specializes in personalization and runs on Snowflake. ASOS has described using Simon AI alongside Braze to personalize and trigger customer communications like push notifications to clients’ phones.
The apparent delivery of the message through ASOS’s own app makes this more concerning than an unsupported social-media claim. It suggests unauthorized use of the notification infrastructure, but does not confirm that the claimed Snowflake compromise occurred or that customer data was stolen.
According to Simon AI, typical customer profiles cover:
- browsing history and products viewed
- purchase history and customer value (first-time or high-value buyers)
- demographic data
- segments such as Premier status or customers who’ve stopped buying
- geolocation and local weather
If the affected systems contain these profiles, a breach could expose a detailed picture of customers’ shopping habits and preferences. However, the published description of ASOS’s marketing setup does not establish what, if anything, the attackers accessed.
The Guardian reports that the group claiming the breach calls itself the “Xuanye group.” The Telegram channel operated by the group carried the message “Regarding Asos, payment information is not affected,” but that claim has not been independently verified.
Sky News reports that a customer-service representative described the push notification as “fraudulent” and said ASOS was investigating.
How to stay safe
The website and app remain operational, and there is currently no verified evidence that customer databases, payment card information, passwords, etc. have been stolen.
So, it’s too early to say if and how much ASOS customer data the attackers could get their hands on, but the potential scope is significant. Customer data could be used in targeted phishing attacks to add credibility.
- For the time being, postpone your purchases at ASOS until it’s clear what happened and whether ASOS has resolved the issue.
- Be wary of unsolicited messaging about the breach or other ASOS related issues.
- If you do not wish to see more push notifications from the Xuanye group, remove the ASOS app until their access has been removed.
- If it turns out your data was stolen in this breach, read the tips in our blog Involved in a data breach? Here’s what you need to know.
What do cybercriminals know about you?
Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online.
About the author
Was a Microsoft MVP in consumer security for 12 years running. Can speak four languages. Smells of rich mahogany and leather-bound books.