Asos hack: the weak link wasn't Snowflake

At about 10am on Tuesday 6 October, people with the Asos app on their phones got a push notification that was not from the fashion retailer's marketing team. "Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us or we will leak it," it read, with a link to a Telegram channel run by a group calling itself Xuanye. Two days later, on 8 October, Asos confirmed that customers' personal details had been taken.

"Follow the evidence, not the attackers' narrative."
— Boris Cipot, Black Duck, via Computer Weekly

A ransom note sent through the front door

Most extortion gangs email the company quietly. This one addressed Asos's data protection officer (DPO) through the app, in front of customers. ESET's Jake Moore called it what was likely "one of the most visible hacks in history", while warning that being able to send notifications didn't by itself prove the gang's wider claims.

Asos's update on 8 October filled in some of the gaps. It said an attacker gained access to an employee account "by impersonating a trusted contact", then used that person's login to reach information on "certain third-party platforms" the company uses. Those platforms have since been locked down. Asos says names, contact details and "certain non-personal account related information" were accessed, but no payment card details or account passwords. It hasn't said how many customers are affected.

The attackers say they took more than that. According to BBC reporting cited by Computer Weekly and Infosecurity Magazine, a sample the group shared included names, addresses, phone numbers, email addresses, customer numbers and search terms used on the app or website. The BBC didn't say whether that sample had been independently verified. Asos shares fell by more than 10% after the alert, The Record reported.

The weak link was a marketing tool, not the vault

Name-dropping Snowflake, the cloud data platform used by Asos and thousands of other firms, made the story sound bigger than it may be. Snowflake said on 9 October that the incident "did not in any way result from a vuln, weakness, flaw or misconfiguration" in its service and that "No remediation is required for Snowflake customers."

The more interesting name is Simon AI. The group told the BBC it got in through Asos's instance of Simon AI, an "agentic" marketing platform (AI software that can take actions, such as targeting and messaging customers, rather than only answering questions) built on top of Snowflake. Malwarebytes researcher Pieter Arntz described the Snowflake connection as indirect for exactly that reason. Simon AI, bought by US software firm Monetate in July, didn't respond to The Record's request for comment, and Infosecurity Magazine had no reply from Monetate either.

Put Asos's account and the attackers' claims side by side and a familiar shape appears. Nobody broke a database. Someone was talked into handing over a login, and that login opened marketing tools wired to customer data and the push-notification button. Every AI tool given that access is another door, only as safe as the least suspicious person holding its keys.

What Asos customers in the UK should do

The UK's National Cyber Security Centre (NCSC) published advice on 6 October telling customers to assume they are affected even if they didn't get the notification. The likeliest knock-on harm is phishing: criminals who know your name, address and searches can write a convincing fake "Asos refund" email or text, as we saw with the Prime Big Deal Days scams.

• Treat unexpected Asos messages with suspicion. Asos says it "would never ask for passwords, security codes or payment details through an unsolicited message or call". The NCSC says not to tap suspicious links, including in push notifications.
• You don't need to cancel your card. Asos says no card data was accessed and that customers don't need to take any action. Do call your bank if you spot payments you don't recognise.
• Tighten your login anyway. The NCSC recommends passkeys, or a strong, unique password with two-step verification, especially if you reused your Asos password elsewhere.
• Complaining. The Information Commissioner's Office (ICO) says to raise a data concern with the organisation first, then complain to the ICO if you're unhappy with the response. Its helpline is 0303 123 1113.

Asos says it is working with law enforcement and regulators. Under UK GDPR, firms must report serious personal data breaches to the ICO within 72 hours of becoming aware of them where feasible, so expect questions about third-party access as well as the phished login.

To be fair to Asos

It locked down the platforms involved quickly and gave a fuller account within 48 hours. Extortion gangs exaggerate for leverage, and this one appeared from nowhere: Group-IB found its Telegram channel was created on 6 October. Cipot's advice cuts both ways, though. The BBC's sample suggests more than "contact details" left the building, and customers deserve a number.

Mind the hype. And mind the push notification that knows your last search.

Sources: Computer Weekly · Computer Weekly · Infosecurity Magazine · Infosecurity Magazine · The Record · Engadget · NCSC · ICO