A ransomware crew that compromised retailer Asos used the company’s own mobile app push notifications to send an extortion message directly to customers. The message claimed the attackers had fully compromised Asos’s Snowflake environment and threatened to leak data if the company didn’t engage. This is a real example of attackers using trusted customer communication channels to apply pressure and shape the narrative.
A ransomware crew that compromised retailer Asos used the company's own mobile app push notification capability to send an extortion message directly to customers. The notification read, "Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it." Instead of contacting the company privately, the attackers broadcast the threat through a channel customers already trust.
The attack succeeded because it repurposed a legitimate, trusted communication channel for an entirely different purpose. Customers who receive push notifications from a retail app expect order updates or promotions, not ransom demands. By exploiting that trust, the attackers guaranteed visibility and created immediate pressure on Asos. As one source observed, direct-to-consumer ransomware demands apply pressure to the impacted company by involving the public in what would otherwise be a private negotiation.
The message was also designed as a piece of propaganda. It referenced internal roles like the DPO and IT team, giving the impression of insider knowledge, and it tried to cast the hacked company as the villain for not engaging in the extortion demands. This framing shifts blame toward the victim organization rather than the attackers, which is a deliberate pressure tactic that security and communications teams should anticipate.
It remains unclear from available reporting how the Snowflake instance was initially compromised, which underscores the importance of not jumping to conclusions about root cause during an active incident.
Security, IT, privacy, communications, and executive teams should prepare in advance for this kind of scenario:
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The attackers used Asos's own mobile app push notification feature to broadcast an alert directly to customers, claiming they had compromised the company's Snowflake instance.
Direct-to-consumer extortion messages apply public pressure on the victim organization and attempt to frame the company as responsible for any resulting data leak.
No, the article notes it is unclear how the Asos Snowflake instance was initially compromised.
Treat alarming messages sent through trusted channels like apps or portals as potentially attacker-driven, and verify any such claims through official status pages and internal incident response processes.
Imagine this: your company app suddenly pushes a message to every customer saying, “Dear DPO and IT, we’ve fully compromised the Snowflake instance. Engage with us, or we will leak it.” That really happened at Asos. A ransomware crew broke in, then used Asos’s own app push system to blast a ransom note to customers, claiming they’d taken over the Snowflake environment and blaming the company for not paying. Here’s the trick: it looks like a normal, trusted app alert, but the language is pure extortion, urgent threats to leak data, calling out internal roles like “DPO and IT” in a customer-facing message, and pushing a narrative that the company is the villain if it doesn’t “engage.” If you ever see ransom or extortion language coming from our own apps or portals, don’t reply or improvise, immediately capture a screenshot and escalate it through our incident response channel so security can take over the messaging.
Attackers used social engineering to access an ASOS employee account connected to Snowflake, then used ASOS’s own app notification system to broadcast an extortion message directly to customers. The incident also involved suspected large-scale customer data theft, which increases the risk of highly…
ASOS confirmed attackers got into customer-data systems after tricking an employee into handing over login credentials. Stolen data reportedly included not only names and contact details, but also customers’ shopping searches, which could enable highly convincing follow-on scams and phishing.…
ASOS says an attacker got into an employee account by impersonating a trusted contact to steal login credentials. Those credentials were then used to access third-party platforms and send a legitimate-looking push notification to customers claiming a Snowflake hack and directing them to a Telegram…
ASOS confirmed an unauthorized push notification was sent to customers through its official mobile app, claiming the retailer was “hacked” and threatening to leak data unless ASOS engaged with the attackers. The message attempted to pressure ASOS’ security and privacy teams and directed the company…
Dutch police are investigating ShinyHunters after a phone-based social engineering incident helped attackers break into Odido, the Netherlands’ largest mobile provider. Investigators say the caller persuaded an employee to log into a spoofed website, which was then used to steal data on more than…
An unknown group suspected to be North Korean state hackers targeted Rust language team members and high-profile package (“crate”) maintainers with phishing that lures victims into a fake conference call. When the victim tries to join, they are told they must install a “video codec” or update…
