Snowflake linked to prior breaches at Ticketmaster and Santander
BBC News cyber correspondent Joe Tidy reported that dozens of ASOS app users across the UK contacted the broadcaster about receiving a strange notification on their phone screens from the clothing and beauty retailer’s app. The message was worded as a direct appeal to ASOS’s internal data protection and IT staff rather than as a communication to customers.
The full text of the message read: “Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.” According to the BBC, the message claimed that unnamed hackers had gained access to data held with Snowflake, a cloud-based data storage company whose popular tools have been used by dozens of firms for collecting, analysing and storing data.
Snowflake has been the subject of many high-profile data breaches in recent years and has been linked to incidents targeting services including Ticketmaster and Santander. It is not known whether ASOS is a customer of Snowflake or what data, if any, is stored with the service.
Although the apparent extortion notice was sent directly to ASOS customers through the retailer’s own app, it was addressed to the company’s data protection officer and IT team. On social media, dozens of people posted about receiving the message, confused as to what it means.
ASOS did not immediately respond to BBC News’s requests for comment.
BBC News said the story was developing and that more details would be published shortly.