ASOS app users receive unconfirmed breach threat

ASOS app users received a threatening notification claiming the retailer’s Snowflake instance had been compromised and warning that information would be leaked unless the company engaged with the sender. ASOS had not confirmed a breach or commented on the claim in reports published Tuesday, October 6, leaving it unclear whether any systems or customer data were accessed. The message, addressed to ASOS’s data protection and IT teams, appeared as a push notification through the shopping app and linked to a Telegram account. It said the sender had “fully compromised” the Snowflake instance and threatened to leak information. The sender’s identity and how the notification reached users were not established in the reports. The number of recipients is unknown. Reports described users in the United Kingdom and other countries receiving the alert, but estimates varied, and no verified total was available. Dozens of people told the BBC they had received it; other reports used estimates of hundreds or thousands without establishing how those figures were determined. The reports also did not establish whether ASOS uses Snowflake or what information, if any, might be stored there.