securityweek.comarticleASOS Confirms Cyberattack, Data Breach
ASOS confirmed attackers compromised a third-party platform used for customer communications, sending UK users rogue mobile notifications claiming "we have fully compromised the Snowflake instance" and threatening to leak data unless engaged. ASOS says only basic user info (names, contact details) may have been exposed, with no impact to payment cards or passwords. A newly surfaced group calling itself Xuanye Group claimed the attack on Telegram; researchers note the extortion-via-direct-notification tactic and possible Snowflake angle mirror the 2024 ShinyHunters mass-extortion campaign against Snowflake customers.
TL;DR ASOS confirms a third-party comms-platform breach and rogue extortion notifications sent to users, with researchers drawing parallels to the 2024 ShinyHunters Snowflake extortion wave.
Technologies named here
- Snowflake
- ASOS mobile app and website
Techniques named here
- Extortion via direct customer messaging
- Credential theft via infostealers for initial access
Threat actors named here
- Xuanye Group
- ShinyHunters
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup