Asos confirms breach of customer data after hackers send rogue app notification

Asos has confirmed a breach in which attackers infiltrated a third-party Snowflake instance used for customer communications, exfiltrating names, addresses, phone numbers, emails and profile notes. The adversary (self-identified as Xuanye Group) used the company’s app notification system to pressure Asos by sending an unauthorized message threatening to publish stolen data, and the intrusion reportedly involved impersonating a trusted contact to obtain login credentials.