ASOS App Users Report Push Notifications Likely Sent by Hackers

ASOS users across the UK have reported receiving pop-up messages from the company's app that appear to have been sent by hackers attempting to extort the company. Dozens of individuals have informed the BBC about receiving a message from the clothing and beauty retailer's app, which appeared on their phone screens. The message states, "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it." ASOS did not immediately respond to the BBC's requests for comment. Charlotte Wilson, head of enterprise at cyber-security firm Check Point, noted, "If confirmed, this is a deeply serious attack because the hackers appear to have done something particularly brazen: turned ASOS's own app into their ransom note." Many users on social media have expressed confusion regarding the message. Although the apparent extortion message was sent directly to customers, it is addressed to ASOS's data protection officer (DPO) and IT team. The message claims that the unnamed hackers have "fully compromised the Snowflake instance," referring to the data storage company Snowflake, which provides tools for collecting, analyzing, and storing data. It is unclear if ASOS is a customer of Snowflake or what data, if any, is stored with the service. Snowflake has been involved in several high-profile data breaches in recent years, including incidents affecting Ticketmaster and Santander. It is unusual for a data breach to be disclosed so publicly and for customers to be informed in this manner, as most extortions and negotiations by cyber criminals are typically conducted privately. The pop-up message includes a link to the hackers' Telegram channel. The group, calling itself Xuanye Group, created its Telegram channel on the same day. They have posted three times, with the latest post concerning the ASOS hack. Dan Bird from cyber security firm Horizon3 stated that the pop-up message implies the hackers' access may extend beyond the Snowflake database. He explained, "Sending a push notification to ASOS's app users would require access to the company's notification system, which is separate from the Snowflake data platform the attackers claim to have compromised." He added, "If both claims hold up, it suggests the attackers got hold of credentials that opened more than one door."