ASOS confirm ‘unauthorised activity’ after customers received threatening app alert in suspected hack

Fast fashion brand ASOS confirmed the “unauthorised customer notification” and believe some “basic personal information” may have been accessed.

Customers in Australia, UK and other parts of the world received a threatening app notification with bewildered customers taking to social media to share screenshots in disbelief.

The message sent on Tuesday claims the company’s system had been breached, with hackers threatening to leak customer data.

“ASOS hacked,” the alert, which was sent about 8pm AEST, reads.

“Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.”

ASOS confirmed the “unauthorised customer notification” sent out at 10am (8pm AEDT) and say they believe basic personal information may have been accessed but payment details and passwords haven’t been compromised.

However, they are still investigating the extent of the breach.

“We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers,” an ASOS spokesperson said in a statement to nine.com.au on Tuesday afternoon (Wednesday morning AEDT).

“We took immediate action to restrict access to the notification platforms and are working with our internal and external specialist advisers, as well as all relevant authorities. 

“Basic personal information including name and contact details may have been accessed. We do not believe that payment-card information or account passwords, were impacted.”

There has been no update on any other data which may have been accessed as of Wednesday morning.

No pop-ups or other messages appear when logging onto the site, with the company confirming the app and website are both operating as usual and there are “no current disruption to any aspects of our operations”.

“Customer trust is incredibly important to us, and if the situation changes an update will be provided as appropriate,” they said.

Speaking to Today, technology expert Trevor Long said the message was designed to be a direct communication between the hackers and the IT department of the company.

“They had sent this notification essentially asking the company to communicate with them,” he said.

“The hackers are asking the company to communicate with them via a direct message to millions and millions of people.

“It would have woken a few people up or make a few people worry.”

He said it was too early to tell the extent of the breach, but admitted it was “possible” the hackers could have gained access to other systems and parts of ASOS.

The link sent to customers via the app message takes people to a newly created channel on messaging app Telegram, labelled Xuanye group gateway.

They later posted a message inside the Telegram channel clarifying the site was safe for customers to use.

“To clear any confusion, the affected organisations app is safe to use,” they said, according to Sky UK.

“The incident involves customer information, it is safe on our server, and it will not be touched for a designated period. Considering the current situation regarding incident disclosure in the cybersecurity landscape, you can thank us for our generous clarity regarding this incident.”

Cybersecurity experts Sophos told British media its specialists hadn’t heard of this group before and it had not come up on any of the channels being monitored by the company.

Charlotte Wilson, head of enterprise at cybersecurity firm Check Point, said if confirmed it would be a very serious breach.

“If confirmed, this is a deeply serious attack because the hackers appear to have done something particularly brazen: turned ASOS’s own app into their ransom note,” Wilson told BBC.

“Millions of people trust notifications from apps on their phones because they are supposed to come directly from the company.”

According to Sky UK, the fashion brand, which is based in the UK, employs about 2800 staff and is worth about £602 million ($1.15 billion).

The global retailer has 16.4 million active customers who have shopped in the last 12 months.

The company’s share price had been on the up before the apparent hack but dived by as much as 15 per cent on the London Stock Exchange across Tuesday, after news of the suspected hack emerged.

In an attempt to put shareholders at ease, ASOS said it’s “too early to quantify any potential impact on trading” but they have cybersecurity insurance with a large global provider if needed.

What’s a Snowflake?

The message claimed the hackers had “fully compromised the Snowflake instance”, which is believed to refer to cloud data storage company Snowflake.

The company is used by a number of retailers to store sensitive customer information and has been the subject of previous data breaches, including Ticketmaster, Live Nation, Santander Bank and AT&T.

Snowflake told nine.com.au they haven’t found any compromise to the Snowflake platform.

“As soon as we became aware of the notification that is currently being reported, we began an investigation,” a spokesperson said.

“At this time, we can report that we have found no compromise of the Snowflake platform.

“We take customer privacy and security very seriously. The investigation is ongoing and we will provide further updates as soon as more information becomes available.”

Cybersecurity expert Dan Bird, from Horizon3, said the message to customers suggested the breach had gone beyond the Snowflake database.

“Sending a push notification to ASOS’s app users would require access to the company’s notification system, which is separate from the Snowflake data platform the attackers claim to have compromised,” Bird told BBC.

“If both claims hold up, it suggests the attackers got hold of credentials that opened more than one door.”

Dray Agha, senior manager of security operations at online security firm Huntress, echoed those sentiments.

“The push notification suggests attackers have breached the systems controlling the ASOS mobile app also. This is clear public extortion,” he told The Guardian.

“Sending a ransom demand directly to consumer devices is an aggressive extortion tactic designed to force the business into a quick negotiation. I strongly advise shoppers to watch out for targeted phishing attempts while we wait for official confirmation of a data breach.”

Under UK law, companies are required to report any personal data breaches to the Information Commissioner’s Office within 72 hours after discovering a breach.

In some instances, they will also be required to report to the National Cyber Security Centre and police.

What should customers do?

Customers are being advised to be on their guard for suspicious activity and follow-up messages.

“High-profile cyber incidents create ideal conditions for phishing attacks,” NordVPN chief technology officer Marijus Briedis said.

“Criminals may exploit the publicity by sending emails and texts claiming to be from ASOS, perhaps asking customers to reset a password, confirm payment details, check an order or claim a refund.”