The push was the ransom note

The ransom note arrived as a push, which is a strange place to learn you have a data-protection officer.

ITPro reports that people across the UK got a notification this morning telling Asos’s DPO and IT that “we have fully compromised the Snowflake instance,” and to engage or the data would be leaked. A link pointed at a Telegram channel created today. Reporting ties that channel to a group being called Xuanye. I am not treating the channel name as an identity.

Asos told ITPro it is investigating activity on third-party platforms it uses to communicate with customers. It said basic personal information, including name and contact details, may have been accessed. It said it does not believe the website and app themselves are disrupted. Snowflake told ITPro that, once it knew about the notification, it looked, and that it has found no compromise of the Snowflake platform. Its investigation is ongoing.

A push to a customer’s phone is proof of a messaging path. It is not proof of a warehouse. Snowflake’s sentence and Asos’s sentence can both be true: the platform vendor’s control plane is intact, and a tenant’s connected app, or the tool that sends the push, was not.

What “Snowflake” will do inside the building

It will start a cloud-IR retainer aimed at the warehouse brand in the criminals’ sentence. The sentence is their label. The artifact is the notification. Whoever can send that push can see a device token and, if Asos is right about the maybe, a name and a way to contact the person. That is a customer-communications system until a query log says otherwise. Pull the sender, the application that holds the push credentials, and the export jobs. Do not open with a slide that says the data cloud fell over.

Customers who got the note do not need to engage the address in it. The company already has the incident. Paying, clicking, or replying confirms the phone is live, which is the one fact the sender was missing even if they already had the name.

The most visible part was the stunt. The part that decides the incident is which system was allowed to talk to the phone.