ASOS Confirms Breach After Attackers Send Unauthorized App Notifications
Summary
ASOS confirmed unauthorized access to third-party customer communication platforms after attackers sent fake breach alerts through its app. Names and contact details may have been exposed; ASOS says payment-card data and passwords do not appear affected.
Key points
- Attackers sent unauthorized push notifications through the official ASOS mobile app, directing the company to a threat actor’s Telegram channel.
- ASOS confirmed unauthorized access to third-party platforms used to communicate with customers.
- Names and contact details may have been exposed, but ASOS has not disclosed how many customers may be affected.
- The attackers claimed they compromised ASOS’s Snowflake environment and stole customer information; ASOS has not confirmed the claim, and the group provided no evidence in the article.
- ASOS says payment-card information and account passwords do not appear to have been affected.
- ASOS displayed an in-app notice advising customers to disregard the unauthorized alert and avoid its external link.
Article Details
- Victim Organization
- ASOS
- Incident Type
- Unauthorized access to third-party customer communication platforms and abuse of the official ASOS mobile app to send unauthorized push notifications. The threat actor also claimed, without evidence, to have compromised ASOS's Snowflake environment and stolen customer information.
- Data Types Exposed
- Names and contact details may have been exposed, according to ASOS.
- Customer information was allegedly stolen, according to the threat actor; the specific information was not disclosed.
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Unauthorized push notifications were sent through the ASOS mobile app. ASOS displayed an in-app notice advising customers to disregard the alert and not engage with its external link. No other operational impact was reported.
- Ransom Or Extortion
- The threat actor threatened to leak data and urged ASOS to engage. It later claimed the allegedly stolen customer information would remain on its server for a designated period. No ransom amount or payment was reported.
- Claim Status
- confirmed