Shoppers opened the ASOS app to an alert addressed to the company’s IT team. What ASOS has confirmed, what may have been exposed, and what customers should do.
Most extortion attacks happen out of view, with private demands and quiet talks. The attack on online fashion retailer ASOS went the other way. On Oct. 6, customers got a push notification through the official ASOS app that was really a message to the company’s own security staff.
What customers saw
According to the BBC, the alert was headlined “ASOS HACKED” and addressed to the company’s data protection officer and IT teams. It claimed the attackers had “fully compromised the Snowflake instance,” a reference to a cloud data platform. It threatened a leak and linked to a Telegram channel.
The notifications arrived around 10 a.m. UK time. Dozens of people told the BBC they had received it, and local outlets reported it reaching users in Australia, France, Sweden and Ireland too. The BBC noted the ASOS Android app has more than 10 million downloads.
What ASOS confirmed
ASOS acknowledged an “unauthorised customer notification” the same day. In its statement, the company said:
- It is investigating unauthorized activity involving third-party platforms it uses to communicate with customers.
- It restricted access to those notification platforms right away and is working with outside specialists and the relevant authorities.
- Basic personal information, including names and contact details, may have been accessed.
- It does not believe payment card details or account passwords were affected.
- The website and app are operating as normal.
ASOS has not confirmed the attackers’ Snowflake claim. When the BBC reported, the company had not yet told the UK’s data watchdog, the ICO, about a breach.
How far it reached
ASOS is not a small target. The BBC reports the retailer serves around 17 million customers a year in more than 150 markets. It’s still unclear how many of them got the alert. Some customers told the BBC that people they knew with the app never saw it, and that has left shoppers unsure whether only the recipients were affected.
That evening, ASOS emailed customers to apologize. It asked them not to engage with the notification and said they could “shop with confidence” while it investigates.
Why this attack stands out
Using the victim’s own customer channel is unusual. Check Point’s Charlotte Wilson told the BBC the hackers had “turned Asos’ own app into their ransom note.” Going public like this piles pressure on the company and stirs up its customers at the same time. ASOS shares fell about 10% that day, the BBC reported.
The BBC also noted that extortion groups rarely contact a victim’s customers directly, since most of these demands stay private. That could make this case a turning point in how such attacks are run.
For any business, it’s a reminder that marketing and messaging tools can be attacked too. Push and email providers often hold customer contact lists, and they can reach every customer in seconds.
What ASOS customers should do
- Don’t tap the link in the notification or join the Telegram channel.
- Don’t panic. Check Point’s Wilson told the BBC customers shouldn’t be frightened, but should take a few basic precautions.
- Change your ASOS password, and change it anywhere else you used the same one.
- Expect phishing. If names and contact details leaked, scam emails and texts posing as ASOS are likely. Go to the site directly instead of clicking links in messages.
- Watch your bank statements, even though ASOS says card data wasn’t affected.
For teams: lock down your messaging stack
- Use single sign-on and multi-factor authentication on every customer messaging and push platform.
- Limit who can send to all customers at once, and require approval for large sends.
- Review third-party access to your data warehouse often.
- Keep a template ready to warn customers if your own channel is hijacked.
Sources
- BBC News: Asos confirms hackers sent ‘unauthorised’ notification (includes ASOS statement)
- Mashable: ASOS hacked, spam messages
