Monitor this situation.

Unsubscribe anytime.

[SITUATION] · [QUIET] · [TECHNOLOGY]

3 clusters · 61 sources · 5 days · First seen 21 days ago · Last updated 16 days ago

ASOS customer data breach and app notification hijack

Overview

British fashion retailer ASOS is investigating a cyberattack involving the hijacking of its mobile app notification system. On October 6, users in several countries received push notifications titled ‘ASOS HACKED’, which contained threats from a group identified as Xuanye Group. The attackers claimed to have compromised a Snowflake instance and threatened to leak data unless demands were met, though Snowflake has denied these claims, stating its own systems were not breached and the issue did not stem from a platform vulnerability.

By October 8, ASOS confirmed that an unauthorized third party had accessed customer names and contact details. The breach occurred after attackers used social engineering to impersonate a ‘trusted contact’ to obtain an employee’s login credentials, which were then used to access certain third-party platforms.

In addition to names, email addresses, phone numbers, and physical addresses, hackers accessed ‘certain non-personal account related information’, including customers' recent website search histories. ASOS clarified that payment card information and passwords were not accessed. The company is currently working with law enforcement and regulatory authorities, including the UK Information Commissioner’s Office, while implementing additional security controls. Following the incident, ASOS shares experienced significant volatility, dropping as much as 12% in value.

Recent updates indicate the breach occurred through Simon AI, a platform built on top of the Snowflake data storage service. Beyond basic contact details, the compromised data includes customer identification numbers and dates of birth. While the Xuanye Group has claimed responsibility for the ASOS incident, they have also claimed involvement in a separate data breach at Air France-KLM involving internal employee files.

Entities

ASOS · Xuanye group · Snowflake · London Stock Exchange · Xuanye

Claims

What the coverage asserts, and how many sources carry each claim.

[● 11 SOURCES] Hackers accessed an employee account by impersonating a trusted contact to obtain login credentials.
[● 6 SOURCES] Payment card details and account passwords were not compromised in the attack.
[● 5 SOURCES] Stolen customer data includes names, home addresses, phone numbers, and email addresses.
[● 4 SOURCES] Snowflake stated that its own systems and platform were not breached or compromised.
[● 3 SOURCES] ASOS has locked down the affected third-party platforms and is working with law enforcement.
[● 2 SOURCES] The breach included customers' recent website search histories.
[● 2 SOURCES] The hackers, identifying as Xuanye Group, sent unauthorized push notifications to customers via the ASOS app.
[● 2 SOURCES] ASOS shares experienced significant volatility, dropping as much as 12% following the incident.
[○ 1 SOURCE] The hacking group, identified as Xuanyewen, claims they gained access by impersonating trusted contacts to obtain an employee's login credentials.

Timeline

16 days ago

[TECHNOLOGY] 6 sources
Asos confirms data breach after hackers use mobile app for extortion
Asos has confirmed a data breach involving customer names, contact details, and browsing history after hackers used the company's app to send threatening notifications. The group also claims a breach at Air_Fr_
19 days ago

[TECHNOLOGY] 18 sources
ASOS confirms customer data breach following cyberattack
ASOS confirmed a data breach after hackers impersonated an employee to access customer names, contact details, and search histories via third-party platforms. Payment data remains secure.
21 days ago

[TECHNOLOGY] 43 sources
ASOS investigates app notification hijack and alleged data breach
ASOS is investigating a cyber incident after hackers hijacked its app to send ‘ASOS HACKED’ notifications to customers, claiming a Snowflake data breach. Basic personal data may have been accessed.

Sources

20minutos.es · ad-hoc-news.de · basingstokegazette.co.uk · brandaktuell.at · businessinsurance.com · cityam.com · claimsjournal.com · communitynews.com.au · cyberinsider.com · cybernoz.com · dday.it · desiblitz.com · drapersonline.com · easterneye.biz · economistas.gr · english.alsiasi.com · europesays.com · extra.ie · extratipp.com · fehmarn24.de · finanzen.net · forbesliberia.com · gulfnews.com · hna.de · ilcorrieredellasicurezza.it · independent.co.uk · internewscast.com · it-boltwise.de · kurier.at · kurierverlag.de · ladbible.com · lesclesdudigital.fr · lifo.gr · malwarebytes.org · mannheim24.de · mashable.com · masstransitmag.com · mediaweek.com.au · merkur-online.de · metro.co.uk · myjoyonline.com · nationaltechnology.co.uk · npinvestor.dk · op-online.de · retailgazette.co.uk · rocketnews.com · ruhr24.de · saferworld.org.uk

This summary has been updated 3 times: see revision history