ASOS Customers Receive Unauthorized Push Notification Claiming Snowflake Compromise
What Happened — Customers of the global fashion retailer ASOS received a push notification from the ASOS mobile app stating that the company’s Snowflake data warehouse had been fully compromised. The message, signed by the “Xuanye group,” was delivered through ASOS’s own notification infrastructure, which relies on third‑party services (Simon AI and Braze). ASOS confirmed an “unauthorised customer notification” and is investigating possible access to personal data.
Why It Matters for Trust & Control Assurance
- The incident highlights the risk of insufficient oversight of third‑party platforms that handle customer data and trigger communications.
- Continuous vendor‑risk monitoring and evidence‑backed assurance are essential to detect and remediate unauthorized use of notification pipelines before they reach end users.
- Demonstrable controls around third‑party access, change‑management, and audit logging provide a defensible trail for regulators and auditors.
Who Is Affected – Retail and e‑commerce organizations that integrate marketing AI or notification services with cloud data platforms (e.g., Snowflake, Braze, Simon AI).
Recommended Actions
- Review and tighten access controls for all third‑party services that can push content to customer‑facing apps.
- Implement continuous monitoring of third‑party API activity and enforce least‑privilege principles.
- Collect and retain logs of notification‑service configurations and changes as audit evidence.
Source: Malwarebytes Labs
Technical Notes – The attackers leveraged the integration between ASOS’s marketing stack (Simon AI on Snowflake) and Braze to send a forged push notification. No specific CVE is cited; the vector is a supply‑chain/third‑party dependency misuse. Personal identifiers (name, contact details) may have been accessed, but payment data appears unaffected. Source: same as above