ASOS Customers Receive Fake “HACKED” Push Notification – Possible Snowflake Data Compromise
What Happened – Customers of the UK‑based fashion retailer ASOS reported a push notification from the company’s mobile app that read “ASOS HACKED” and demanded ransom for a claimed compromise of its Snowflake data warehouse. ASOS confirmed an unauthorized notification was sent, restricted access to the affected communication platform, and began an investigation with specialist advisers and regulators.
Why It Matters for Trust & Control Assurance
- This scenario tests the control objective of third‑party vendor oversight – ensuring that any external platforms used to reach customers are continuously monitored and that evidence of proper due‑diligence is retained.
- A robust continuous‑control‑assurance program would have documented the security posture of the notification service, enabling a defensible audit trail and rapid containment.
- The incident highlights the need for real‑time evidence collection on third‑party integrations, a core capability of Verisq’s Vendor Risk Management offering.
Who Is Affected – Retail & e‑commerce firms that rely on third‑party communication channels and cloud data platforms (e.g., Snowflake).
Recommended Actions
- Map the third‑party notification service to your vendor‑risk control framework (e.g., NIST CSF 2.0 Identify/Protect functions).
- Collect and retain evidence of access controls, configuration baselines, and monitoring logs for all external communication platforms.
- Conduct an immediate risk assessment of the Snowflake environment and any other cloud services linked to the app.
Technical Notes – The push notification was delivered via the ASOS mobile app, likely leveraging a third‑party push‑notification service. The attackers referenced a Snowflake instance but provided no proof of data exfiltration. No payment‑card data or passwords were reported as compromised. Source: The Record