ASOS app push notifications hijacked to send extortion note; attackers claim Snowflake compromise
On October 6, 2026, ASOS app users received a push notification stating the company had been hacked, sent by attackers who gained access to third-party customer messaging platforms used by ASOS. The note, addressed to ASOS's DPO and IT team, claimed the Snowflake instance was "fully compromised" and threatened a leak unless ASOS engaged. It was signed "xuanyewengateway" and linked to a Telegram channel of a group calling itself the Xuanye Group. ASOS confirmed unauthorised activity and said names and contact details may have been accessed, while payment card details and passwords were reportedly unaffected. Snowflake says it found no compromise of its platform, and the data warehouse claim remains unverified. ASOS shares fell more than 10% on the day.
Technical Details
- The initial access vector has not been disclosed. The article speculates credential theft, phishing, or weak authentication, such as a dashboard login without MFA or a leaked API key or service token for the push/marketing platform.
- Infosecurity Magazine reported that ASOS uses Simon AI for marketing, which runs on Snowflake. This could link the notification tooling to the data warehouse but is unconfirmed.
- Snowflake's denial is consistent with attackers using stolen customer credentials, as in the 2024 UNC5537 campaign, but this is not established for ASOS.
- Notifications were sent in English and Hebrew and reached users in the UK and other countries, including Israel.
- Unanswered as of October 9: which platforms were accessed, how credentials or keys were obtained, whether data was exfiltrated, and how many customers are affected.
Remediation
- ASOS locked down access to the notification tools and engaged outside experts and authorities.
- Rotate API keys and service tokens for push and marketing platforms, and enforce MFA on their dashboards.
- Review third-party integrations and their access to data warehouses such as Snowflake.
- Customers should not contact the Telegram channel, should expect phishing using their names and emails, should change reused passwords and enable MFA.
Linha do tempo
-
ASOS app push notifications hijacked to send extortion note; attackers claim Snowflake compromise
ler a análise desta fonte ocultar
On October 6, 2026, ASOS app users received a push notification stating the company had been hacked, sent by attackers who gained access to third-party customer messaging platforms used by ASOS. The note, addressed to ASOS's DPO and IT team, claimed the Snowflake instance was "fully compromised" and threatened a leak unless ASOS engaged. It was signed "xuanyewengateway" and linked to a Telegram channel of a group calling itself the Xuanye Group. ASOS confirmed unauthorised activity and said names and contact details may have been accessed, while payment card details and passwords were reportedly unaffected. Snowflake says it found no compromise of its platform, and the data warehouse claim remains unverified. ASOS shares fell more than 10% on the day.
Technical Details
- The initial access vector has not been disclosed. The article speculates credential theft, phishing, or weak authentication, such as a dashboard login without MFA or a leaked API key or service token for the push/marketing platform.
- Infosecurity Magazine reported that ASOS uses Simon AI for marketing, which runs on Snowflake. This could link the notification tooling to the data warehouse but is unconfirmed.
- Snowflake's denial is consistent with attackers using stolen customer credentials, as in the 2024 UNC5537 campaign, but this is not established for ASOS.
- Notifications were sent in English and Hebrew and reached users in the UK and other countries, including Israel.
- Unanswered as of October 9: which platforms were accessed, how credentials or keys were obtained, whether data was exfiltrated, and how many customers are affected.
Remediation
- ASOS locked down access to the notification tools and engaged outside experts and authorities.
- Rotate API keys and service tokens for push and marketing platforms, and enforce MFA on their dashboards.
- Review third-party integrations and their access to data warehouses such as Snowflake.
- Customers should not contact the Telegram channel, should expect phishing using their names and emails, should change reused passwords and enable MFA.