ASOS app users have received disturbing push notifications, apparently sent by hackers. The messages, which appear on the app, claim the company’s Snowflake instance has been fully compromised and demand engagement from the DPO and IT team, or risk a data leak. At least 40 users have reported receiving the message, which is also posted on social media. The hackers have set up a Telegram channel, calling themselves the Xuanye Group, and have only posted three times, including the ASOS hack.

Charlotte Wilson, head of enterprise at Check Point, notes the severity of the attack. ‘Millions of people trust notifications from apps on their phones because they are supposed to come directly from the company,’ she said. ‘This is a deeply serious attack because the hackers appear to have done something particularly brazen: turning ASOS’s own app into their ransom note.’

While ASOS has not yet responded to the BBC, the incident highlights the risks of third-party data storage services. Snowflake, whose tools are used by ASOS, has faced many high-profile data breaches in recent years. However, this is very unusual for a data breach to be revealed in such a public manner, especially with customers informed directly. Most extortions and negotiations by cybercriminals are conducted in private, with the hope of a quiet pay-off.

According to Dan Bird, from cyber security firm Horizon3, the push notifications imply that the hackers have access to the company’s notification system, separate from the Snowflake data platform they claim to have compromised. ‘Sending a push notification to ASOS’s app users would require access to the company’s notification system, which is separate from the Snowflake data platform the attackers claim to have compromised,’ he explained. ‘If both claims hold up, it suggests the attackers got hold of credentials that opened more than one door.’