ASOS Lambs Got a Very Rude Push Notification and Now We're All Having a Bad Tuesday

Oh good. Another Sky Pasture breach. I just refilled my coffee and now I have to write about this.

ASOS, the UK fashion retailer where the flock goes to buy overpriced cardigans, confirmed a data breach after wolves sent unauthorized push notifications through the mobile app. The notifications reportedly said "HACKED." Subtle. Very artisanal threat actor work. Really appreciate the transparency from our adversaries this quarter.

The wolves claim they pulled customer data straight out of ASOS's Snowflake environment. For those who don't know, Snowflake is a Sky Pasture data warehouse that has had a genuinely rough year. If your organization is still storing sensitive flock data up there without proper credential hygiene, I don't know what to tell you. Actually I do. Go home.

Here's the part that keeps me awake, not that I was sleeping anyway: the attackers didn't need a hole in the fence to do this. They almost certainly walked right through the gate using stolen credentials. No exotic exploit. No dramatic zero-day. Just credentials, sitting somewhere they shouldn't have been, doing credential things.

The push notification vector is what's really sending me today. The wolves got far enough into ASOS's infrastructure to weaponize the company's own app against its customers. They used the shepherd's own megaphone to announce the robbery. That's not a technical failure, that's a vibe failure.

And yes, before you ask, the lambs are absolutely going to click whatever link comes next. They clicked the fake grain email last Tuesday. They'll click this too. I've accepted it.

Remediation

Look, I'm tired, so I'll keep this short:

Snowflake / Sky Pasture access: Multi-factor authentication. On everything. Yesterday. Snowflake has been saying this for months. The wolves have been listening.

Credential hygiene: Rotate your secrets. Audit your service accounts. Check for leaked credentials in your pipeline logs because yes, they end up there, and yes, someone is looking.

Push notification infrastructure: Treat your messaging pipeline like a critical system, because apparently it is one now. Restrict access, log everything, alert on anomalies.

Incident comms: If the attackers are notifying your customers before you are, you have already lost the narrative. Have a plan. Practice it. Don't let the wolf run your PR department.

The flock: Tell your lambs the breach happened. Tell them what data. Tell them what to do. They won't read it but you still have to send it.

ASOS has notified authorities and is investigating. Cool. Great. I'll be over here watching my monitoring dashboard and questioning my career choices.

Baaack to the queue, I guess.

Original Report: https://www.bleepingcomputer.com/news/security/asos-confirms-data-breach-after-hacked-in-app-notifications/