UK retailer Asos falls 10%+ after customers received app notifications saying "we have fully compromised the Snowflake instance"; source: Asos is investigating

The possibility of a breach extends beyond a data warehouse to a company's direct customer communication channels, impacting trust.

UK retailer Asos experienced a significant stock price drop of over 10% following reports that customers received push notifications from the Asos app claiming hackers had compromised the company's Snowflake instance. The message, appearing as a direct notification to users, warned Asos's data protection officer and IT team that the Snowflake instance was fully compromised and threatened to leak the data if the company did not engage. Cyber-security experts noted the unusual and brazen method of using the customer-facing app as a ransom note. They also highlighted that sending such a notification would require access to Asos's separate notification system, suggesting the attackers may have gained broader access beyond just the Snowflake database. Asos is reportedly investigating the incident.

The incident at Asos, if confirmed, signals a concerning escalation in attack vectors, moving from solely targeting data repositories to leveraging trusted communication channels like mobile app push notifications. This tactic turns a company's own infrastructure into a weapon, directly broadcasting threats to its customer base. It forces organizations to reconsider not just the security of their databases but also the integrity of their customer-facing applications and notification systems, as a compromise in one can rapidly expose the other.

This event underscores a growing trend where sophisticated threat actors are finding creative and disruptive ways to apply pressure during extortion attempts. For retailers and any company relying on direct customer engagement, it necessitates a robust, multi-layered security strategy that encompasses not only data protection but also the safeguarding of all communication platforms. The swiftness with which this breach was made public to users, and the subsequent stock price reaction, indicates the market's heightened sensitivity to the operational and reputational risks associated with such public-facing attacks.