Asos Data Breach Confirmed After Rogue App Notification
The Asos data breach has been confirmed by the U.K. fashion retailer after hackers used the company’s own app to notify customers that its systems had been compromised. The company disclosed the incident in a filing with the London Stock Exchange, confirming that customer data was accessed without authorization.
The Asos data breach involved a third-party platform that the retailer uses to communicate with its customers. Names and contact information were taken in the attack, according to the company’s filing.
Reports indicate that the stolen data also includes home addresses, phone numbers, and email addresses, along with notes relating to customer profiles, such as website search queries. Asos has approximately 17 million customers, according to its website.
How the Asos Data Breach Unfolded
The Asos data breach became public after hackers sent an unauthorized customer notification through the retailer’s app. Many recipients shared the message on social media, drawing widespread attention to the incident.
The notification addressed Asos’ data protection officer and IT department directly. It claimed that the hackers had “fully compromised” the company’s data hosted on Snowflake, a platform that allows corporate customers to analyze large amounts of data.
“Engage with us, or we will leak it,” the notification read.
By using the app’s own notification system to alert customers, the hackers appear to be attempting to pressure the company into engaging with them. If Asos does not respond, the attackers have threatened to publish the stolen data online.
How Hackers Reportedly Gained Access
The hackers reportedly broke into the Snowflake instance by impersonating a trusted contact to obtain login credentials. Snowflake has stated that it did not experience a breach of its own systems.
It remains unclear whether the Asos-run Snowflake instance was protected with multi-factor authentication. It is also unknown how the hackers gained access to Asos’ system for sending in-app push notifications, which is often handled by a third-party service.
The hackers, who go by the handle Xuanye Group, have not indicated how much data they allegedly possess. The full scope of the Asos data breach therefore remains uncertain.
What Asos Has Said
In its filing with the London Stock Exchange, Asos confirmed that names and contact information were taken. The company has not publicly detailed how many customers were affected or whether it plans to notify individuals directly.
The retailer has also not indicated whether it will engage with the hackers or how it plans to respond if the stolen data is published. The incident remains under investigation.
A Growing Pattern of Third-Party Attacks
The Asos data breach fits a broader pattern of cyberattacks targeting third-party platforms that companies rely on to reach customers. These vendors often hold sensitive data and can become a direct channel for attackers to reach millions of people.
Earlier this year, fintech giant Betterment was compromised by hackers who used their access to a third-party marketing platform. The attackers impersonated the company and sent a crypto scam to its customers. During that breach, the hackers also accessed customer names, email addresses, and phone numbers, among other data.
For Asos customers, the incident highlights how much personal information retailers hold and how quickly a compromised vendor can become a tool for attackers.
What Customers Should Watch For
With names, addresses, phone numbers, and email addresses reportedly exposed, affected customers face a higher risk of phishing and impersonation scams. The Asos data breach could be used by criminals to craft convincing fraudulent messages.
Be cautious of unexpected messages claiming to be from Asos, especially any requesting login details or payment information.
Treat unsolicited emails or texts referencing your account, order history, or personal details with suspicion.
Monitor for unusual activity tied to the contact information you shared with the retailer.
Customers should also watch for messages that reference specific details, such as their address or recent searches, since this information may have been exposed.
Key Takeaways
Asos confirmed a data breach after hackers sent a rogue notification through the retailer’s own app.
Names and contact information were stolen; reports indicate home addresses, phone numbers, email addresses, and customer profile notes were included.
Hackers claim to have compromised Asos data hosted on Snowflake and are threatening to leak it.
Snowflake says its own systems were not breached.
The attackers, known as Xuanye Group, have not said how much data they hold.
The full scope of the Asos data breach and its impact on the company’s 17 million customers remains unclear.
The Asos data breach serves as a reminder that third-party platforms can become weak points in a company’s security. As investigations continue, customers should stay alert for suspicious communications and monitor their accounts for unusual activity. Asos has not provided further details on the scale of the breach or its next steps.
