Attackers abused ASOS’s own mobile app messaging to send customers a threatening push notification claiming ASOS’s Snowflake environment was compromised and demanding engagement to avoid a data leak. ASOS confirmed the notification was unauthorized and warned customers to watch for follow-on phishing after potential exposure of names and contact details.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you’re shopping on the ASOS app and a push pops up saying their Snowflake data is fully hacked and your info will be leaked unless they ‘engage’. That really happened. Attackers pushed a fake breach and extortion message through ASOS’s own app, claiming a full Snowflake compromise and threatening to leak data unless ASOS talked to them. Here’s the twist: ASOS said only names and contact details may have been exposed, not cards or passwords. That means the real risk is follow-on phishing that looks like ‘ASOS support’ emailing or texting you about this scare. If you get a breach or data-leak alert from any brand’s app, don’t tap it, go to their official website or help center yourself and check there instead.
ASOS customers received an unexpected push notification inside the official ASOS app claiming the retailer had been hacked and demanding engagement to prevent data leaks. ASOS confirmed it was an “unauthorised customer notification” tied to third‑party messaging platforms and said it restricted…
ASOS says an attacker got into an employee account by impersonating a trusted contact to steal login credentials. Those credentials were then used to access third-party platforms and send a legitimate-looking push notification to customers claiming a Snowflake hack and directing them to a Telegram…
ASOS customers received an unauthorized push notification sent through ASOS’s real mobile app. The message claimed ASOS’s Snowflake environment was compromised and urged recipients to contact the sender via Telegram, leveraging the trust people place in official app notifications. ASOS said it was…
Attackers used social engineering to access an ASOS employee account connected to Snowflake, then used ASOS’s own app notification system to broadcast an extortion message directly to customers. The incident also involved suspected large-scale customer data theft, which increases the risk of highly…
ASOS confirmed attackers got into customer-data systems after tricking an employee into handing over login credentials. Stolen data reportedly included not only names and contact details, but also customers’ shopping searches, which could enable highly convincing follow-on scams and phishing.…
ASOS confirmed an unauthorized push notification was sent to customers through its official mobile app, claiming the retailer was “hacked” and threatening to leak data unless ASOS engaged with the attackers. The message attempted to pressure ASOS’ security and privacy teams and directed the company…
