ASOS Breach Reveals the Risks in Customer-Facing SaaS

ASOS was breached after a threat actor known as "Xuanye Group" impersonated a trusted contact to obtain an employee's login, which was then used to access third-party marketing/notification systems (and possibly a Snowflake instance). The attackers exfiltrated大量 customer PII and broadcast malicious push notifications to app users; they claim payment data was not affected. The incident highlights weak protections around customer-facing marketing platforms and the risk of attackers communicating directly with customers under a trusted brand.