Asos confirms breach of customer data after hackers send rogue app notification
- ID
- 33225
- Status
- summarized
- Published
- 08 Oct 2026, 11:01 PM
- Fetched
- 08 Oct 2026, 11:10 PM
- Provider
- TechCrunch
- Category
- technology
- Original URL
- https://techcrunch.com/2026/10/08/asos-confirms-breach-of-customer-data-after-hackers-send-rogue-app-notification/
- Source URL
- https://techcrunch.com/feed/
Summary
- Score
- 5.5
- Created
- 08 Oct 2026, 11:11 PM
- Tags
- Audience
- developersdatabase_learnerssaas_startup_founders
What happened
Asos confirmed a customer-data breach after hackers used its own app notification system to send an unauthorized message addressed to its data protection officer and IT department. BBC News reports the stolen data includes names, home addresses, phone numbers, emails, and customer-profile notes such as website search queries; the hackers, Xuanye Group, claimed the data was hosted on Snowflake and threatened to leak it. Bleeping Computer reports the Snowflake instance was accessed by impersonating a trusted contact to obtain login credentials; Snowflake says its systems were not breached, and MFA status is unclear.
Why it matters
If your startup uses Snowflake or third-party push/notification providers, this incident shows the practical risk is credential impersonation and third-party access, not a platform-wide Snowflake compromise. Check whether your Snowflake account enforces MFA and who can trigger customer-facing notifications; otherwise this is mostly a UK retail breach with limited direct impact on most builders.
Discussion angle
What minimum controls should be required for third-party data platforms and notification services, especially MFA and impersonation-resistant support flows, after a breach like this?