A ransom note sent through ASOS’s own app, and what it does and doesn’t prove

Attackers exploited third-party messaging platforms used by ASOS to send an unauthorized push notification to ASOS app users, delivering an extortion demand claiming full compromise of ASOS's Snowflake instance. The attackers' communication channels were active before the notification, indicating premeditated public pressure. ASOS confirmed the unauthorized notification and restricted access to its notification platforms, stating that names and contact details may have been accessed, but payment information and passwords were not believed to be affected. Snowflake denied any compromise of its platform. The attackers have not provided data samples or proof of access. This incident resembles a prior attack on Betterment, where unauthorized messages preceded data leaks. ASOS customers face increased risk of phishing and fraud due to exposed contact data and credential lists circulating on criminal forums.

ASOS customers may have had their names and contact details accessed, increasing the risk of targeted phishing and fraud. Payment card information and passwords are not believed to be affected. The unauthorized notification caused reputational damage and public concern. The incident demonstrates that attackers can misuse third-party communication platforms to reach customers directly. There is no confirmed data leak or proof of Snowflake compromise at this time. The incident may lead to follow-on fraud attempts leveraging the exposed contact information and previously leaked credentials.

ASOS has restricted access to its notification platforms and is investigating the incident. Customers are advised to disregard the unauthorized notification and not to follow any links it contained. The UK National Cyber Security Centre (NCSC) recommends that all ASOS customers assume they are affected and exercise caution against phishing attempts. No further immediate action is required from customers beyond vigilance. Organizations should ensure strong identity controls on systems that can message customers, similar to payment system controls, to prevent misuse.