ASOS Confirms Cyberattack, Data Breach
ASOS confirmed a third-party notification platform was hacked, potentially exposing customer names and contact details.
British online retailer ASOS told the London Stock Exchange that attackers compromised a third-party customer-communication platform and pushed unauthorized app notifications. The messages claimed ASOS’s Snowflake instance was fully compromised and threatened to leak data unless the company engaged. ASOS said names and contact details may have been accessed, but not payment-card data or passwords, and that its website, app, and operations were not disrupted. A group calling itself Xuanye Group claimed the incident on Telegram; researchers said that claim is unconfirmed and could be a false flag.
- ASOS confirmed a hacked third-party notification platform sent rogue alerts.
- Attackers claimed full compromise of an ASOS Snowflake instance.
- Company says only names and contact details may be exposed.
- Payment cards, passwords, website, and operations were not affected.
- Xuanye Group claimed responsibility on a new Telegram channel.
Full article450 words · extracted from securityweek.com · click to collapse
British online retailer ASOS has confirmed that hackers compromised a third-party communication platform after users received rogue notifications on their phones.
Over the past couple of days, numerous ASOS users in the UK complained about receiving a pop-up notification on their mobile apps, titled “ASOS hacked”.
“Dear ASOS DPO [data protection officer] and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it,” the notification read.
In a Tuesday filing with the London Stock Exchange, the clothing and cosmetics retailer confirmed that its users received unauthorized notifications after a third-party platform used for customer communication was hacked.
“We took immediate action to restrict access to the notification platforms and are working with our internal and external specialist advisers, as well as all relevant authorities,” ASOS said.
According to the company, the hackers might have accessed basic user information, including names and contact details.
Advertisement. Scroll to continue reading.
“We do not believe that payment-card information or account passwords were impacted,” the company said.
ASOS pointed out that its website and application have not been affected, and that its operations have not been disrupted.
The company has not shared details on which platform was compromised and who was behind it, and made no mention of its Snowflake instance being hacked.
“Snowflake is a data analysis and AI platform used by several organizations. In 2024, ShinyHunters hacked Snowflake instances of over 160 organizations and stole sensitive data that was used for extortion. They used credentials obtained from infostealers for initial access. This recent hack may be similar, although it is not confirmed what the initial access was,” said Forescout Research – Vedere Labs VP of research Daniel dos Santos.
The incident was claimed by a hacking group calling itself Xuanye Group, on a newly created Telegram channel. The name points to a Chinese-speaking threat actor, but could also be a false flag, dos Santos said.
“If the attackers have successfully compromised ASOS via a Snowflake vulnerability, hopefully this will be investigated as a priority to understand whether this could impact further organizations utilizing the online data platform,” Talion Cyber Security head of threat intelligence Natalie Page said.
“Directly messaging customers via the ASOS app is an interesting move which highlights that the attackers want to gain publicity around the breach. This is a typical tactic of extortion groups, who often leverage media attention and publicity to apply further pressure to victim organizations,” Page added.
Related: 8.8 Million Impacted by Data Breach at Denmark’s Central Person Register
Related: 250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms
Related: Pentagon Personnel Agency Data Breach Impacts 3 Million People
Related: DC Health Agency Exposes 400,000 Beneficiary Records