Skip to content

ASOS app users receive push notifications from hackers

techOct 6, 20265578

Dozens of ASOS app users in the UK received an unexpected push notification claiming unnamed hackers had "fully compromised the Snowflake instance" and instructing ASOS to engage or face a leak, the BBC reports. The pop-up included a link to a newly created Telegram channel calling itself Xuanye Group; the channel had three posts with the latest about ASOS. ASOS did not immediately respond to the BBC, and the retailer's website and app remained online while customers posted screenshots and confusion on social media. Charlotte Wilson, head of enterprise at Check Point, called the incident "deeply serious" because attackers turned ASOS's own app into a ransom note and people trust app notifications. Dan Bird of Horizon3 said sending a push notification would require access to ASOS's notification system, implying the attackers may have obtained credentials that open multiple systems beyond any Snowflake instance. It is not known whether ASOS uses Snowflake or what data, if any, is stored there; ASOS has launched an investigation into the unauthorised activity involving third-party platforms it uses.

1 source