Asos app delivers a data leak threat instead of fast fashion

1. Executive summary

Asos customers received a rogue push notification through the retailer's own app claiming that Asos's Snowflake instance had been compromised and threatening to leak data unless the company engaged with the sender. The message named Asos's data protection officer and IT team, and pointed recipients to a Telegram channel called "Xuanye Wen Gateway". The notification does not by itself establish that the sender accessed Asos's Snowflake instance or any customer data, and how the message was delivered through the app remains unclear. Asos's share price fell around 12 percent on the reports before recovering slightly. For EMEA financial services clients the direct exposure is limited, but the incident is a live example of extortion messaging delivered through a trusted first-party channel, and of the Snowflake credential-theft playbook that hit Santander and dozens of other organisations in 2024.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The affected entity is a UK online retailer, not a financial entity or an ICT third-party provider to one, and no fact in the source establishes a link to a client's own ICT systems or supply chain. The 2024 Snowflake campaign is relevant background, not a trigger for this item.

3. Technical analysis & attack chain

The source does not describe a confirmed intrusion. What is confirmed is the delivery of a notification through the Asos app, its content, and the market reaction. The technical mechanism by which the message was sent is not established in the source, and no CVE, exploited component, or malware sample is named.

Confirmed elements:

1. A notification was delivered to Asos customers through the Asos app.
2. The notification text read: "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it."
3. The notification included a link to a Telegram channel named "Xuanye Wen Gateway".
4. Asos's share price fell by around 12 percent following reports of the notification, then recovered slightly.

What the source does not establish, and what should not be assumed:

• That the sender accessed Asos's Snowflake instance.
• That any customer data was accessed or exfiltrated.
• How the notification was sent. The source states this remains unclear. Plausible routes (compromise of a push-notification provider, abuse of an app backend, or a third-party marketing or messaging integration) are not confirmed by the source and are not asserted here.
• Whether the Telegram channel is operated by the same party that sent the notification, or whether it is a contact channel set up for the extortion attempt.

The Snowflake reference is significant context. In 2024 a data theft campaign targeted Snowflake customers including Ticketmaster, Santander, AT&T and dozens of others. Connor Riley Moucka, 26, of Kitchener, Ontario, later pleaded guilty to computer fraud, wire fraud, aggravated identity theft and conspiracy charges over a hacking spree that compromised more than 165 organisations, exposed billions of customer records, and brought in about $2.5 million in ransom payments. Snowflake subsequently introduced controls allowing administrators to require multi-factor authentication. The source does not state that the 2026 Asos notification is connected to that campaign, to Moucka, or to any named actor, and no attribution is made here.

Confidence caveat: the entire factual basis for this item is a single source, The Register. The notification content, the Telegram channel name, the share-price movement and the absence of confirmation from Asos and Snowflake all rest on that one report. The Register states it has asked Asos and Snowflake to comment. Treat the claim of a Snowflake compromise as unverified and single-sourced; verify before acting on it.

4. Mitigation & containment

The technical mitigations below address the Snowflake credential-theft pattern that this incident invokes, not a confirmed Asos compromise. They are relevant to any client running Snowflake or comparable cloud data platforms.

P1 (within 24h)

• Enforce MFA on all Snowflake accounts. Snowflake added administrator controls to require MFA; if your tenant does not have it enforced, enable it now. This is the single control that most directly addresses the 2024 campaign pattern.
• Audit Snowflake user accounts for unexpected additions, role changes, or new personal access tokens. Review ACCOUNT_USAGE login history for authentications from unfamiliar IP ranges or user agents.
• Review app push-notification and in-app messaging integrations for unauthorised senders or API keys. If you operate a customer-facing app, confirm which third parties can send notifications through it and rotate any credentials those integrations use.

P2 (within 72h)

• Rotate credentials for any service account or integration with access to Snowflake or equivalent data platforms, particularly where those credentials are long-lived or shared.
• Restrict Snowflake network access to known IP ranges or require network policies where your tenant supports them.
• Confirm that no Snowflake account uses a password without MFA, and that no account has been granted ACCOUNTADMIN without a documented reason.

P3 (within 7 days)

• Review third-party and marketing integrations that can reach customers through your own channels (app push, email, SMS). Treat the ability to send a message to your entire customer base as a privileged capability and apply the same access controls you would to a data export.
• Tabletop the scenario in this item: an extortion message delivered through your own trusted channel, naming your DPO. Confirm who would receive it, who would verify it, and how you would communicate to customers without amplifying the attacker's claim.

5. Indicators of compromise

No indicators of compromise available in the source material. The source names a Telegram channel ("Xuanye Wen Gateway") but provides no URL, handle, or other machine-pivotable value, and no hashes, domains, IPs, or file artefacts are given.

Behavioural indicators:

6. Detection

Insufficient indicators to author detection rules. The source provides no distinctive strings, command-line flags, file names, registry keys, or other artefacts of a threat. The notification text and Telegram channel name are the attacker's own words, but they are not tied to a file, process, or network artefact that a detection rule could match against, and the delivery mechanism is unknown. Authoring a rule on the channel name or the message text would detect reporting about this incident, not the incident.

7. Sources

• The Register, "Asos app delivers a data leak threat instead of fast fashion", https://www.theregister.com/security/2026/10/06/asos-app-delivers-a-data-leak-threat-instead-of-fast-fashion/5301332, 2026-10-06.

8. Adverse Trace position

We assess this as a low direct risk to EMEA financial services clients and a moderate reputational and operational risk to any client running Snowflake or a comparable cloud data platform. The claim of a Snowflake compromise is unverified and rests on a single source; the notification does not by itself establish that any data was accessed. The pattern it invokes, credential theft against cloud data platforms followed by extortion, is the one that hit Santander and more than 160 other organisations in 2024, and MFA enforcement remains the control that most directly addresses it. We will monitor for confirmation or denial from Asos and Snowflake, for any technical detail on how the notification was delivered, and for any link between this incident and the 2024 Snowflake campaign. Clients running Snowflake should treat the P1 items in section 4 as due now regardless of how this particular incident resolves.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.