Extortion note meant for ASOS's IT team lands on customers' phones through the retailer's app

The people who got the message did what users do with a notification that makes no sense. They posted it. Dozens wrote about it on social media, confused about what it meant, the BBC reported ^[3]. Dexerto saw one user's screenshot, and others said they had received the same text that Tuesday morning, October 6 ^[5][10].

The message makes one claim, and the way it arrived shows a second thing. Only the second has been shown to happen. The claim is about data: "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it." ^[6] The act is about distribution. Someone sent unauthorised text to ASOS users through the official app ^[10][8].

Nobody has verified the data claim. The BBC reported that it is not known whether ASOS is a Snowflake customer or what data, if any, it keeps there ^[13]. According to Dexerto, the notification does not say what was accessed or whether customer information was involved ^[11]. ASOS has not confirmed a breach or said how the message was sent ^[8]. It is not yet clear whether the push channel and any Snowflake data were reached in the same intrusion. Naming Snowflake makes the threat sound plausible. Dozens of firms use the platform to collect, analyse and store data ^[12], and the BBC reported that it has been linked to incidents targeting Ticketmaster and Santander ^[9].

The addressing is where this becomes a product problem. The note was written to a data protection officer and an IT team, and it went to shoppers ^[7]. I think the split is deliberate. A demand that lands in a DPO's inbox can be handled inside the company. A demand that lands on customers' lock screens has a public audience before the company has a statement, and ASOS did not immediately respond to the BBC ^[4].

The users here read a message under the ASOS icon as ASOS talking to them. The BBC reported that what confused them was what it meant ^[3]. Inside a company, push often counts as a campaign channel, measured on opens. To the person holding the phone, it is the company speaking. If the push console sits with the campaign tools, more people and systems can send a message to every customer than can read the customer database.

The test I would apply tomorrow is a 2x2. One axis counts the accounts, human or machine, whose credentials can send to your full app audience: few or many. The other asks whether a send to the full audience needs a second person to approve it. Few senders plus an approval step is a setup you can explain on Friday. Many senders and no approval is the quadrant where an outsider's text can reach customers before anyone inside sees it. In the two mixed quadrants, I would fix the approval step first. It closes the gap even before you have tracked down every credential.