Cybersecurity
ASOS confirms breach after in-app hack alerts
ASOS said unauthorised access to customer communication platforms may have exposed names and contact details after attackers used its mobile app to send breach notices and made separate claims about Snowflake.
- ASOS said third-party platforms used to communicate with customers were accessed without authorisation.
- The company said basic personal information, including names and contact details, may have been exposed.
- ASOS said it did not believe payment-card information or account passwords were affected.
- The company had not confirmed the attackers’ claim that its Snowflake environment was compromised or said how many customers may have been affected.
ASOS said on Tuesday that third-party customer communication platforms had been accessed without authorisation. It said basic personal information, including names and contact details, may have been exposed.
The company displayed an in-app notice telling customers to ignore the unauthorised alert and not to use the external link it contained. ASOS said it did not believe payment-card information or account passwords were affected.
The alerts began appearing at about 5:00 a.m. ET on Tuesday and said the retailer had been compromised. The message directed ASOS to a Telegram channel run by a group calling itself Xuanye.
On that channel, the group first said payment information had not been affected and later posted a statement claiming it had stolen customer information. It did not say what information it claimed to have taken, how many customers were affected, or provide evidence that it had accessed ASOS’s Snowflake environment.
Named in this story
Companies
- ASOS
- confirmed that customer communication platforms were accessed without authorisation
Organisations
- Xuanye group
- said it operated the Telegram channel and made the breach claims
Products and systems
- Snowflake
- was named by the attackers as the environment they claimed to have compromised
How the source tells it
Mostly neutral reporting, with alarm introduced by the attackers’ own messages and the in-app breach notice.
- alarm the piece repeated the breach alert and the attackers’ claims of compromise