Story perspectives

ASOS Warns of Snowflake Hack After Push Extortion

By Drooid · Oct 6, 2026, 3:14 PM UTC · How we work

Summary

ASOS Data Extortion

ASOS sent a push notification on 6 October 2026 claiming its Snowflake instance was fully compromised.
The alert threatened to leak data unless the attackers were engaged and linked to a Telegram channel named Xuanye.
ASOS shares dropped over 10%, wiping about £70 million from market value on Tuesday.
NordVPN CTO Marijus Briedis warned customers of possible phishing, calling the message unusually brazen.

Summary

Attackers Hijack API

Attackers likely leveraged compromised credentials to hijack ASOS’s notification API.
The extortion group used Telegram to demand payment, following a trend among financially motivated attackers.
Analysts recommend rotating all Snowflake API keys and enforcing multi-factor authentication immediately.
Organizations should audit notification-system logs for anomalies and apply least-privilege controls.
The attack employed Valid Accounts (T1078) and Cloud Service Dashboard persistence (T1098.003) techniques.

History

Historical Context

The 2017 Equifax breach, disclosed in September 2017, exposed personal data of 147 million Americans and triggered a $700 million settlement. Federal Trade Commission, Consumer Financial Protection Bureau, and Equifax each faced fines totaling $425 million, illustrating regulatory penalties for lax security. Similarly, ASOS’s October 2026 Snowflake compromise, reported by NordVPN CTO Marijus Briedis, leveraged stolen credentials and Telegram extortion, echoing Equifax’s credential-based exploitation. The Equifax fallout prompted industry-wide adoption of multi-factor authentication and API key rotation, steps now urged for cloud services to prevent repeat incidents.

1 of 3

ASOS Data Extortion

ASOS sent a push notification on 6 October 2026 claiming its Snowflake instance was fully compromised.
The alert threatened to leak data unless the attackers were engaged and linked to a Telegram channel named Xuanye.
ASOS shares dropped over 10%, wiping about £70 million from market value on Tuesday.
NordVPN CTO Marijus Briedis warned customers of possible phishing, calling the message unusually brazen.

1 / 3