[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjjjWNlII5dB1Y3T5x9PUOrYmzzZ99rkBhnkG1rRBio8":3},{"article":4,"iocs":46,"watch_terms":51,"solutions":52,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"75d1dc11-2ed2-4aa4-8796-6bfa24ca2f14","ASOS Confirms Cyberattack, Data Breach","asos-confirms-cyberattack-data-breach-b8e584","Hackers compromised a third-party communication platform and sent rogue notifications to ASOS users. The post ASOS Confirms Cyberattack, Data Breach appeared first on SecurityWeek.","Online retailer ASOS has confirmed a cyberattack where hackers compromised a third-party communication platform, sending unauthorized notifications to users. The attackers claimed to have compromised ASOS's Snowflake instance and threatened to leak data. While ASOS stated that payment information and passwords were not impacted, basic user information like names and contact details may have been accessed. The group Xuanye Group has claimed responsibility.","ASOS confirms cyberattack after hackers sent rogue notifications to users via a third-party platform.","https:\u002F\u002Fwww.securityweek.com\u002Fasos-confirms-cyberattack-data-breach\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FAsos.jpeg","2026-10-07T09:46:20+00:00","2026-10-07T10:00:07.323214+00:00",7,[17,20,23,25],{"name":18,"type":19},"Snowflake","product",{"name":21,"type":22},"Xuanye Group","threat_actor",{"name":24,"type":22},"ShinyHunters",{"name":26,"type":27},"ASOS","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":28,"icon":30,"name":31,"slug":32},null,"Breaches","breaches",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":48,"value":49,"context":50},"malware","infostealers","Credentials obtained from infostealers were used for initial access in similar past attacks on Snowflake instances.",[26,18],{"controls":53,"vendors":138},[54,83,109],{"slug":55,"name":56,"problem":57,"products":58},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":84,"name":85,"problem":86,"products":87},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[88,93,101],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":89,"product_name":90,"url":91,"description":92},"falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"slug":110,"name":111,"problem":112,"products":113},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":157},"asos-breach-highlights-third-party-platform-risk-and-cloud-data-exposure","ASOS Breach Highlights Third-Party Platform Risk and Cloud Data Exposure","The ASOS breach originated through a compromised third-party communication platform, illustrating how attackers exploit trusted vendor relationships to gain access to customer data and internal systems. The alleged compromise of ASOS's Snowflake cloud instance underscores the growing risk of inadequately secured cloud data warehouses, which often hold vast amounts of sensitive customer information. Even when payment credentials and passwords are not exposed, the leak of names and contact details enables follow-on attacks such as phishing and social engineering. This incident matters because organizations frequently extend implicit trust to third-party platforms without enforcing the same security controls they apply internally. Retailers handling large volumes of customer PII must treat every vendor integration as a potential attack surface.",[144,145,146,147,148,149,150,151,152,153,154,155,156],"CIS Control 15 – Service Provider Management","CIS Control 3 – Data Protection","CIS Control 6 – Access Control Management","NIST SP 800-161 – Supply Chain Risk Management","NIST AC-2 – Account Management","NIST AC-3 – Access Enforcement","NIST SI-12 – Information Management and Retention","GDPR Article 28 – Processor Obligations","GDPR Article 33 – Notification of a Personal Data Breach","GDPR Article 25 – Data Protection by Design and by Default","ISO\u002FIEC 27036 – Information Security for Supplier Relationships","NIST CSF PR.AC-3 – Remote Access Management","NIST CSF DE.CM-7 – Monitoring for Unauthorized Activity",{}]