ASOS Customers Receive Fake Breach Alerts Linked to Suspected Snowflake Incident
Shoppers received push notifications claiming a Snowflake data breach compromised ASOS systems, raising concerns about credential theft.
Key points
- ASOS customers received push notifications claiming the retailer’s IT systems were breached via Snowflake.
- The alerts appear to be a phishing attempt rather than a confirmed compromise of ASOS infrastructure.
- The incident highlights the risk of social engineering attacks leveraging cloud platform reputations.
ASOS customers have received deceptive push notifications claiming that the online fashion retailer’s IT systems were breached through a vulnerability in the Snowflake data cloud platform. According to Infosecurity Magazine, the messages appeared legitimate to recipients but are part of a suspected phishing campaign rather than evidence of an actual intrusion into ASOS systems.
The notifications reportedly informed users that their personal data had been exposed due to a Snowflake breach. This specific narrative leverages the high profile of Snowflake, a widely used data cloud service, to lend credibility to the fraudulent alert. By associating the fake breach with a known enterprise technology provider, attackers aim to induce urgency and fear in recipients, prompting them to click through to malicious landing pages or provide sensitive credentials.
Context and Background
The incident underscores the evolving tactics of cybercriminals who utilize social engineering to bypass technical defenses. Rather than attempting to exploit zero-day vulnerabilities in ASOS’s direct infrastructure, the attackers targeted the customer base directly through mobile devices. The use of push notifications is particularly effective because these alerts often appear on the lock screen or in notification centers, where users may not scrutinize the sender’s identity or the URL before interacting with the message.
Snowflake has been a frequent subject of social engineering campaigns in recent years. Attackers often claim that data stored within Snowflake environments has been leaked, even when the actual breach occurs elsewhere or is entirely fabricated. In this case, Infosecurity Magazine reports that the connection to Snowflake is part of the suspected compromise narrative used to deceive ASOS shoppers, rather than a confirmed technical failure of the cloud provider itself.
Who Is Affected
The primary targets of this campaign are ASOS customers who have the retailer’s mobile application installed and have enabled push notifications. Any user who received the alert and interacted with it may be at risk of having their login credentials or payment information stolen. The impact is currently limited to those who fell for the deception, as there is no indication that ASOS’s actual backend systems or Snowflake databases were compromised.
Security professionals note that retail customers are frequent targets for such attacks due to the high volume of personal and financial data associated with their accounts. The legitimacy of the ASOS brand further reduces skepticism among recipients, making the fraudulent message appear more plausible.
What should you do?
Individuals who received similar alerts should verify the information through official channels rather than clicking links in the notification. Users should check for official statements on the ASOS website or trusted news sources. If a user has already entered credentials into a site linked from such a notification, they should immediately change their passwords for that account and any other accounts using the same credentials.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: ASOS
- Verify the authenticity of any breach alert by visiting the company’s official website directly, rather than using links provided in notifications or emails.
- Enable multi-factor authentication on all retail and financial accounts to add a layer of security even if passwords are compromised.
- Monitor bank and credit card statements for unauthorized transactions following any interaction with suspicious alerts.
- Review mobile device settings to ensure push notifications are only enabled for verified applications and consider disabling them for non-essential apps.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did ASOS actually suffer a data breach through Snowflake?
No, according to Infosecurity Magazine, the reports of a breach are linked to a suspected phishing campaign using fake notifications, not a confirmed technical compromise.
Why did the attackers mention Snowflake in the fake alerts?
Attackers likely mentioned Snowflake to lend credibility to the scam, as it is a well-known data platform, making the claim of a cloud-based breach seem more plausible to victims.
What should I do if I clicked the link in the ASOS notification?
If you clicked the link, you should immediately change your ASOS password and any other passwords that are the same, and monitor your financial accounts for suspicious activity.
