ASOS App Users Wake Up to a ‘HACKED’ Alert: What the Retailer Has Confirmed So Far
Online fashion retailer ASOS confirmed a data breach after attackers pushed an extortion message to its app users. Here is what is confirmed, what is only claimed, and what is still unknown.
Early Tuesday morning, customers of UK online fashion retailer ASOS found an unusual message on their phones, sent through the company’s own app. It announced that ASOS had been hacked. Later that day, ASOS confirmed a data breach. ASOS sells clothing, shoes, accessories and beauty products worldwide, including in the United States, so the alert reached a broad audience. Here is a briefing that separates fact from claim.
What ASOS has confirmed
- Third-party platforms the company uses to communicate with customers were accessed without authorization.
- Basic personal information, including names and contact details, may have been exposed.
- ASOS does not believe payment card details or account passwords were affected.
- The app now shows a notice telling customers to ignore the unauthorized alert and not to click or engage with the outside link it contained.
What the attackers claim
- The push notifications started around 5:00 a.m. ET. Addressed to the company’s data protection officer and IT team, they claimed the attackers had fully compromised ASOS’s Snowflake instance and threatened a leak unless the company engaged.
- The message pointed to a Telegram channel run by a group calling itself the “Xuanye group.”
- In Telegram posts that morning, the group first said payment information was not affected. It later posted a “final statement” claiming it had taken customer information and was holding it on its own server.
What is still unknown
- ASOS has not confirmed that its Snowflake environment was breached.
- Neither ASOS nor the attackers have said how many customers are affected, and the group has not said what data it allegedly took.
- The group has offered no evidence of the Snowflake compromise. When BleepingComputer tried to reach it, the only contact option required payment, and the outlet declined.
- Reports on Reddit suggest the alert went to many, possibly all, app users.
Lawrence Abrams reported the incident for BleepingComputer as the alerts were arriving, and that article has the full wording of the messages.
What this means for your company
- Your messaging tools are part of your brand. Push, SMS and email platforms can broadcast to every customer at once. Protect admin accounts on these services with strong MFA and limit who can send.
- Inventory third-party platforms that hold customer data. Marketing, notification and analytics services often have copies of contact lists. Know which ones you use and who manages access.
- Prepare a customer-facing response in advance. ASOS was able to post an in-app warning. Decide now how you would tell customers to ignore a fraudulent message sent in your name.
- Expect follow-on phishing. Exposed names and contact details make convincing scams easier. Warn customers how you will and won’t contact them.
Need help securing the customer messaging and marketing platforms your business relies on? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
