Multiple ASOS customers reported receiving unusual pop-up messages through the clothing and beauty retailer’s mobile application. The messages, which appeared to come from unauthorized parties, contained an apparent extortion demand directed at the company’s data protection officer and IT team, claiming full compromise of a Snowflake instance and threatening to release data if ASOS did not engage with the senders.
Snowflake is a data storage company whose cloud-based tools are widely used by organizations for data collection, analysis, and storage. While it remains unclear whether ASOS uses Snowflake’s services or what information might be involved, the company has experienced multiple high-profile security incidents affecting various customers in recent years, including major breaches linked to Ticketmaster and Santander.
The public nature of the apparent extortion attempt is unusual within cybercriminal operations, which typically conduct negotiations discreetly to facilitate quiet settlements. Industry analysts noted the particular audacity of the attack, with cyber-security experts describing it as a significant threat due to the hackers’ apparent ability to weaponize the company’s own communication channels to reach millions of users. Security researchers emphasized that users generally trust app notifications because they expect them to originate directly from legitimate companies.
Asos did not provide an immediate response to requests for comment regarding the incident. The company’s communication status and any steps being taken to address the situation remain unclear. The incident highlights broader concerns about application security and the potential for compromised systems to be repurposed for criminal communication with company officials and their user bases simultaneously.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI