Asos hack: why marketing tools hold your Snowflake keys

How did hackers send a ransom note through the real Asos app? Reporting points to a conned employee and, per researcher Kevin Beaumont, Simon AI, a composable customer data platform owned by Monetate that reads straight from Snowflake with MFA optional and off by default. That route is unconfirmed. The episode argues the real failure is ownership: marketing bought it, data engineering wired it to the warehouse, and nobody owned the login. You leave with a concrete audit: list every third-party tool holding warehouse credentials, check whether MFA is enforced or only available, check whether it can message customers, and fix the risky ones with mandatory MFA or single sign-on before Friday. 0:00 Asos app push notification ransom note 1:55 Social engineering and the Simon AI CDP 3:31 Optional MFA on Snowflake-connected tools 6:17 Why composable CDPs are a data leader problem 7:31 Breach scale, extortion deadline, open questions 8:28 Auditing third-party warehouse credentials this week