ASOS app users report spam messages following security breach

UK fashion retailer ASOS is facing a security incident after users reported receiving unauthorized pop-up notifications within the company's official mobile app. The messages, which appear to originate from a group calling itself the "Xuanye Group," claim that the company's Snowflake data instance has been compromised and threaten to leak information if demands are not met. While ASOS has not yet issued an official statement, the incident has triggered widespread concern among customers. Security experts advise users to avoid interacting with the app and to refrain from clicking any links contained in the suspicious pop-up messages, as these lead to external Telegram channels used by the attackers. The breach highlights ongoing vulnerabilities in third-party data integrations and the potential for attackers to leverage internal communication channels to reach end users directly.