Asos Claims Hackers Breached Snowflake‑Connected Simon AI, Exfiltrating Customer Data
What Happened — Hackers identifying themselves as the Xuanye Group announced they had compromised Simon AI, a marketing‑AI service that runs on Asos’s Snowflake data warehouse. Using stolen employee credentials, they accessed the Snowflake instance and extracted names, addresses, dates of birth, phone numbers, email addresses and browsing histories of millions of Asos customers.
Why It Matters for Trust & Control Assurance
- This incident illustrates the exact scenario a continuous third‑party risk‑management program is built to prevent: unauthorized credential use on a cloud‑based vendor integration.
- Demonstrable oversight of vendor access (least‑privilege policies, real‑time monitoring, and audit‑ready evidence) is essential to prove due diligence to auditors and regulators.
- Leveraging a Trust Center that aggregates third‑party access logs into a single, defensible audit trail helps organizations respond quickly and document compliance.
Who Is Affected – Retail & e‑commerce firms that rely on SaaS marketing or analytics tools integrated with cloud data platforms (e.g., Snowflake, Azure, AWS).
Recommended Actions
- Conduct an immediate inventory of all third‑party integrations that have privileged Snowflake access.
- Enforce least‑privilege and time‑bound credentials for vendor accounts; rotate secrets regularly.
- Enable continuous monitoring of Snowflake activity logs and set up alerts for anomalous data‑export patterns.
- Review and update your incident‑response playbook to include third‑party credential compromise scenarios.
- Document all remediation steps in a centralized Trust Center for audit readiness.
Technical Notes – The breach stemmed from a social‑engineering attack that tricked an Asos employee into revealing valid Snowflake credentials. No payment‑card data were reported as compromised. The attackers leveraged the Simon AI integration to query and export structured customer records directly from Snowflake’s Data Cloud. Source: DataBreachToday