ASOS Investigates Unauthorized Customer App Notification and Possible Data Access
Summary
ASOS confirmed an unauthorized customer notification and said basic personal information may have been accessed. Attackers’ claims remain unverified; Snowflake said it had found no compromise of its platform at that point.
Key points
- ASOS confirmed an unauthorized notification was sent through its app, directing the company to contact the sender on Telegram.
- ASOS said names and contact details may have been accessed; payment-card information and account passwords were not believed to be affected.
- The attackers’ claims about a Snowflake compromise remain unverified. Snowflake said its investigation had found no platform compromise at that point.
- ASOS said the activity involved third-party customer-communication platforms; the article notes the claimed Snowflake connection could have been indirect.
- A message delivered through a genuine company app can bypass warning signs such as an unfamiliar sender or suspicious domain.
- The article advises investigating platform access, credential and permission changes, connected services, and related activity across systems.
- The incident could prompt follow-on phishing or fraud using the event and customer contact details as context.
Article Details
- Topic
- ASOS customer notification incident and the security risks of attackers misusing trusted customer communication channels
People
Products
Snowflakea hostile push notification delivered through the retailer’s own app. The message claimed the company’s Snowflake environment had been compromised and directed ASOS to engage with the sender through Telegram. ASOSTelegramcompany’s Snowflake environment had been compromised and directed ASOS to engage with the sender through Telegram. ASOS later confirmed to Sky News that an unauthorized customer notification had been sent and said it