ASOS Attacker Used the Retailer's Own App to Announce a Breach

ASOS confirmed a data breach after an attacker impersonated a trusted contact and obtained an employee login, according to information shared with Enterprise Security Tech.

The attacker then accessed third-party platforms the retailer uses to communicate with customers and sent a “HACKED” push notification through the ASOS app. Names, contact details and account information were reportedly accessed, while payment information was not.

Claims that the attacker compromised an ASOS Snowflake environment have not been confirmed, and Snowflake has said its platform was not compromised. That distinction matters because attackers frequently mix verifiable actions with broader, unsupported claims.

The incident shows why marketing and messaging platforms belong in the enterprise threat model. They can hold customer data and speak through a trusted brand channel. Security teams should inventory those platforms, enforce phishing-resistant authentication for administrators, limit data access and prepare to revoke compromised integrations quickly.