LONDON, October 7 — British online fashion retailer ASOS suffered a cybersecurity breach on October 6, according to ICE, targeting its Snowflake cloud data platform and notification system. The attackers exploited the compromised infrastructure to send a push notification to thousands of ASOS app users, including Israeli customers, claiming full compromise of the Snowflake environment and threatening to leak sensitive data unless the company’s Data Protection Officer and IT team engaged via a Telegram channel. The notification was delivered in both English and Hebrew, indicating a broad user reach.
The attackers likely gained initial access through credential theft, phishing, or weak authentication mechanisms, then escalated privileges to control the notification system and broadcast the message to all app users. The Snowflake platform, a widely used cloud-based data warehousing solution, centralizes sensitive business and customer data; if the claim of full compromise is accurate, exposed data could include customer records, transaction histories, and internal analytics.
As of the publication date, the exact scope of data accessed or exfiltrated remained unclear, but the extortion attempt suggests privileged access was achieved. The attack involved lateral movement within the cloud environment, persistence, and command over critical systems, with Telegram used as a command-and-control and extortion channel—a tactic aligned with recent financially motivated cybercrime trends. Indicators of compromise include the push notification content, anomalous Snowflake access logs, and unauthorized Telegram links in internal or customer-facing systems.
Organizations using Snowflake or similar platforms were advised to review access logs for anomalies, rotate all credentials and API keys, enhance monitoring for suspicious authentication, and secure notification systems with strong authentication, least-privilege controls, and regular audits. The incident’s tactics align with MITRE ATT&CK techniques such as Valid Accounts (T1078), Exploit Public-Facing Application (T1190), Cloud Service Dashboard (T1098.003), Application Layer Protocol: Web Protocols (T1071.001), Use of Third-party Services (Telegram) for C2, Exfiltration Over Web Service (T1567), and Data Manipulation (T1565).
No direct attribution to a known APT group had been made as of the report, though the incident resembled prior breaches involving Snowflake and other SaaS platforms. Mitigation required comprehensive log review, credential rotation, monitoring for further attacker communication, law enforcement coordination, and customer notification per regulatory requirements. Organizations were urged to strengthen cloud security posture with robust credential management and multi-factor authentication.
