Asos hack shows your marketing tools hold the warehouse keys

On 6 October, Asos app users got a push notification headed "ASOS HACKED". According to BankInfoSecurity, the message read "We have fully compromised the Snowflake instance," demanding Asos "engage with us, or we will leak it," with a link to a Telegram channel for Xuanye Group. Investors reacted before anyone knew the facts. WWD reports shares of Asos closed down 10.6 percent to 449 pence on Tuesday.

Asos's explanation is ordinary. BankInfoSecurity says investigators traced the breach to an attacker tricking an employee into believing they were a legitimate contact, obtaining legitimate access credentials that were then used on certain third-party platforms. The group told the BBC it went through Simon AI, a platform built on Snowflake that Asos uses for customer personalization, according to Malwarebytes. TechCrunch, citing the BBC, reports the stolen data includes home addresses, phone numbers, and email addresses, as well as notes on customer profiles such as website search queries.

This matters to data leaders because the abused system is a data productdata productA data asset managed like a product, with an owner, defined users, guaranteed quality, and measurable business value.View full definition →. Simon AI is a "composable" customer data platformcustomer data platformSoftware that unifies customer data from every source into one persistent profile that marketing, sales and service teams can act on.View full definition →: it reads customer data where it already sits, in the warehouse, so its login works as a door into that warehouse. It could also talk to customers. A vendor case study quoted by BankInfoSecurity says Simon enabled Asos to trigger push notifications in response to a shopper's activity in-app. Dark Reading notes that of Asos's 2,800 employees, the attacker only needed one's login credentials.

The route in is still disputed. Security researcher Kevin Beaumont said Simon AI "doesn't require MFA for accounts," that the portal "is all over infostealer logs," and "This was the route into Asos." Malwarebytes reports Snowflake found no compromise of its platform, and adds that available reporting does not establish a vulnerability in Snowflake or Simon AI. Dark Reading says neither Asos nor independent researchers have been able to confirm this detail. One more objection: multi-factor authentication helps against replayed passwords, but much less against a con artist talking an employee through it live.

What to watch: Asos has not said how many people are affected. Its customer base is around 17 million, according to the company. The group told The Telegraph it would hold the data for two weeks. Also watch whether Monetate makes MFA mandatory, and whether other Simon AI customers turn up in the next leak.