Asos Claims Hackers Breached Snowflake‑Connected Simon AI, Exfiltrating Customer Data

What happened

The Xuanye Group announced they had compromised Simon AI, a marketing AI service running on Asos’s Snowflake data warehouse. By obtaining legitimate employee credentials, they accessed and exfiltrated names, addresses, dates of birth, phone numbers, email addresses and search histories of Asos customers across the UK, Ireland, the US and other regions.

Why it matters for trust and compliance

• The incident highlights a control‑objective gap in third‑party access governance; continuous monitoring and evidence collection for vendor privileges are core to NIST CSF 2.0’s Identify and Protect functions and to maintaining a defensible audit trail.
• Provides a real‑world example of why continuous third‑party credential monitoring is essential for audit readiness.
• Demonstrates the value of a centralized Trust Center to collect and present evidence of vendor oversight to regulators and auditors.

Who is affected

Recommended actions

1. Inventory all third‑party integrations with privileged cloud access.
2. Enforce least‑privilege, time‑bound credentials and rotate secrets regularly.
3. Activate continuous monitoring of Snowflake activity logs and set anomaly alerts.
4. Update incident‑response plans to cover third‑party credential compromise.
5. Document remediation steps in a Trust Center for audit‑ready evidence.