Attackers used social engineering to access an ASOS employee account connected to Snowflake, then used ASOS’s own app notification system to broadcast an extortion message directly to customers. The incident also involved suspected large-scale customer data theft, which increases the risk of highly convincing follow-on phishing using stolen personal details.
The incident began with a classic social engineering move: attackers impersonated a trusted contact to trick an ASOS employee into handing over login credentials. That access led to an account on Simon AI, a platform integrated natively into Snowflake, which ASOS used as cloud infrastructure. From there, attackers reportedly accessed customer data and, in an unusual twist, used ASOS's own app notification system to send an extortion demand directly to customers. The push notification was titled "ASOS HACKED" and read, in part, a message addressed to ASOS's DPO and IT team demanding engagement or threatening a data leak.
The core failure point was trust. An employee responded to what appeared to be a legitimate request from a known contact, without the kind of verification that would normally catch credential theft attempts. Once inside, the attackers had access to a sensitive data platform, and crucially, they also had access to customer-facing communication tools. Using those tools to deliver the extortion message turned an internal security incident into a public pressure campaign, since customers receiving an alarming notification directly from a trusted brand app amplifies urgency and reputational stakes far beyond a typical ransom note sent only to the company.
Organizations should treat customer communication channels, such as in-app notifications, email, and SMS platforms, as high-value targets that need the same access controls and monitoring as core data systems. Access requests that invoke a "trusted contact" should be verified through a separate, known channel before credentials or access help are provided. Staff should be trained to recognize that urgency and familiarity are common manipulation tactics. Finally, because stolen personal details can fuel more convincing follow-on phishing, customers and frontline support teams should be warned in advance not to engage with unsolicited messages claiming to be from the company, particularly ones asking for further verification or claiming an account has been locked.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers used social engineering, impersonating a trusted contact to obtain an employee's login credentials for an account on Simon AI, a platform integrated into Snowflake.
Instead of a typical ransom note sent privately, the attackers used ASOS's own app notification system to broadcast an extortion demand directly to customers, addressed to the DPO and IT team.
ASOS warned that customer names and contact details may have been accessed, and later reporting suggested broader theft including addresses, phone numbers, emails, customer numbers, and dates of birth.
Customers should be cautious of anyone claiming to be from the company asking for further information or claiming an account is locked, and should avoid engaging with unsolicited outreach.
Imagine our app suddenly sends everyone a push alert: “ASOS HACKED” with a ransom note. That really happened. Attackers tricked an ASOS employee by impersonating a trusted contact, stole their Simon AI login tied into Snowflake, then used ASOS’s own app notifications to broadcast an extortion demand to customers. Here’s the twist: the push said, “Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.” A customer alert, talking to internal teams, in ransom language, that’s the red flag. If anyone, even a familiar name, asks for your Simon AI, Snowflake, or messaging-tool login, stop and verify through a separate channel. Your one “no” can prevent our app from shouting a ransom note to customers.
ASOS confirmed attackers got into customer-data systems after tricking an employee into handing over login credentials. Stolen data reportedly included not only names and contact details, but also customers’ shopping searches, which could enable highly convincing follow-on scams and phishing.…
ASOS says an attacker got into an employee account by impersonating a trusted contact to steal login credentials. Those credentials were then used to access third-party platforms and send a legitimate-looking push notification to customers claiming a Snowflake hack and directing them to a Telegram…
ASOS customers received an unexpected push notification inside the official ASOS app claiming the retailer had been hacked and demanding engagement to prevent data leaks. ASOS confirmed it was an “unauthorised customer notification” tied to third‑party messaging platforms and said it restricted…
ASOS confirmed an unauthorized push notification was sent to customers through its official mobile app, claiming the retailer was “hacked” and threatening to leak data unless ASOS engaged with the attackers. The message attempted to pressure ASOS’ security and privacy teams and directed the company…
Attackers abused ASOS’s own mobile app messaging to send customers a threatening push notification claiming ASOS’s Snowflake environment was compromised and demanding engagement to avoid a data leak. ASOS confirmed the notification was unauthorized and warned customers to watch for follow-on…
Asos customers received a mobile app notification claiming the retailer was “fully compromised” and warning of a Snowflake data breach. The alert included a link that redirected users to a Telegram channel allegedly run by a new cyber gang (“Xuanye”), suggesting a social-engineering attempt…
