Asos investigates unauthorized access after customer notifications — The Guardian
In the United Kingdom, online clothing retailer Asos is investigating unauthorized access to its app system after thousands of customers received push notifications claiming that the company’s data had allegedly been fully compromised. The Guardian reports.
Asos said that an unidentified third party may have gained access to customers’ basic personal information, including names and contact details. At the same time, the company does not believe that payment card details or passwords were compromised.
In-app message
The notification, titled Asos hacked, contained a link to the Telegram messenger. The message claimed that attackers had allegedly fully compromised a Snowflake instance. Snowflake is a cloud platform for storing, processing and analyzing data, including transaction and demographic information, as well as for sending push notifications to phones.
The Telegram channel linked in the notification is likely owned by the Xuanye group. Its representatives also said that payment information was not affected, but provided no further details. Cybersecurity experts said they had not previously heard of the group.
More current news is available on the UA.News Telegram channel Telegram.
Company and market reaction
Asos said it had restricted access to platforms used to send messages to customers and was working with internal and external specialists, as well as relevant authorities. According to the company, its website and app are operating normally without disruption.
After the notifications were sent, Asos shares on the London Stock Exchange fell by more than 14%. The decline later narrowed to about 11% after the company said it had cyber-risk insurance, including business interruption insurance. Asos said it was currently too early to assess the incident’s possible impact on trading.
The UK’s National Cyber Security Centre offered the company assistance. Specialists also warned Asos customers about possible phishing emails and messages in which attackers may ask them to change a password, confirm payment details, check an order or arrange a refund.
