Attackers Hijack ASOS Mobile App to Display Fake ‘Store Hacked’ Notification
What Happened — Attackers posing as the “Xuanye group” injected a fraudulent pop‑up into the ASOS shopping app, claiming the retailer’s Snowflake data‑warehouse had been compromised and demanding a ransom. ASOS confirmed unauthorized activity involving third‑party platforms used for customer communications and began restricting access while investigating.
Why It Matters for Trust & Control Assurance
- Highlights a gap in continuous oversight of third‑party communication services – a control objective that continuous monitoring programs are built to address.
- Demonstrates the need for auditable evidence of vendor access restrictions and incident‑response documentation to satisfy multiple framework requirements.
- Shows how a single compromised external channel can affect millions of customers, underscoring the importance of a defensible, real‑time vendor‑risk posture.
Who Is Affected — Global fast‑fashion retailer ASOS, its 17 million customers, and any organizations that rely on similar third‑party notification or cloud‑warehousing services.
Recommended Actions
- Conduct an immediate review of all third‑party notification and data‑warehousing integrations; enforce least‑privilege access and MFA for vendor accounts.
- Capture and retain detailed logs of vendor interactions as evidence for audit readiness and to support incident‑response investigations.
- Update third‑party risk‑management policies to include continuous monitoring of communication channels and real‑time alerting. Source: https://www.databreachtoday.com/attackers-hijack-asos-app-to-say-store-hacked-a-33029
Technical Notes — The attackers leveraged an unauthorized push‑notification pathway, referencing a Snowflake instance that Snowflake later said showed no evidence of compromise. No payment‑card data or passwords were confirmed stolen; only basic personal details may have been accessed. Source: https://www.databreachtoday.com/attackers-hijack-asos-app-to-say-store-hacked-a-33029