ASOS App Push Notification Hijack Leads to Snowflake Data Exposure
What Happened — Attackers compromised ASOS’s mobile‑app notification service and used it to push malicious messages to users. The same actors then accessed the Snowflake data warehouse backing ASOS’s commerce platform, exfiltrating customer‑profile data. ASOS confirmed the incident and is working with law‑enforcement and Snowflake to contain it.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential protection for third‑party cloud services – a core control area that continuous‑monitoring programs must evidence.
- Highlights the need for real‑time detection of anomalous API activity and push‑notification abuse, providing a defensible audit trail for incident response.
- Aligns with the Access Control objective in NIST CSF 2.0, which maps to multiple frameworks (ISO 27001, SOC 2, etc.) through a single control.
Who Is Affected – Global e‑commerce retailers, cloud data‑warehouse users, and any organization that integrates push‑notification services with third‑party analytics platforms.
Recommended Actions
- Review and rotate all API keys and service‑account credentials used for push‑notification and data‑warehouse integrations.
- Enable continuous monitoring of privileged‑access logs in Snowflake and enforce anomaly‑detection alerts for unusual query patterns.
- Validate that third‑party vendors follow documented credential‑management policies and can provide evidence of compliance. Source: HackRead
Technical Notes – Attack vector: stolen service‑account credentials used to invoke the notification API and Snowflake’s REST endpoints. Data types exposed: customer email addresses, purchase histories, and hashed passwords. No public CVE; the breach stems from credential compromise and insufficient segmentation. Source: HackRead