ASOS has confirmed unauthorized access to third-party customer communication platforms after attackers sent push notifications through its mobile app. The ASOS data breach may have exposed customer names and contact details, although the number of affected people remains unknown.
The retailer said it does not believe the incident affected payment-card information or account passwords. However, it has not confirmed the attackers’ separate claim that they compromised its Snowflake environment.
Customers Receive Alerts Through the Official App
The unauthorized notifications began appearing at approximately 5 a.m. Eastern Time on October 6.
The messages announced a hack and demanded that ASOS contact the attackers. They also threatened to release data allegedly taken from the company’s Snowflake environment.
Customers reported receiving the same alert on their phones, indicating that the campaign reached multiple app users. Nevertheless, the available information does not establish how widely the attackers distributed it.
The notification included a link to a Telegram channel associated with a group calling itself Xuanye.
ASOS Warns Users to Ignore the Message
Following the incident, ASOS placed a notice inside its app explaining that the push notification was unauthorized.
The company told customers to disregard the alert and avoid clicking or interacting with the external link it contained.
ASOS also confirmed that someone had accessed third-party platforms it uses to communicate with customers without permission. According to the retailer, the incident may have exposed basic personal information, including names and contact details.
However, the company has not disclosed how many customers may be affected or detailed the full scope of the unauthorized access.
Snowflake Compromise Claim Remains Unverified
The attackers claimed they had fully compromised ASOS’s Snowflake environment and stolen customer information. However, they provided no evidence in the reported messages to substantiate that claim.
Their later statement repeated that the incident involved customer data but did not identify the information allegedly taken. It also omitted a record count or any verifiable indication of the claimed access.
Consequently, the confirmed ASOS data breach and the alleged Snowflake compromise remain distinct parts of the story. ASOS has acknowledged unauthorized access to communication platforms, while the attackers’ broader account remains unverified.
Payment Details and Passwords Believed Unaffected
ASOS said it does not believe payment-card information or account passwords were involved in the incident.
The attackers also claimed that payment information was unaffected. Nevertheless, their statement does not independently verify the retailer’s assessment or establish the boundaries of the breach.
For now, the confirmed findings concern unauthorized access to customer communication services and the possible exposure of names and contact details. The number of affected customers, the precise information accessed and the validity of the Snowflake claim remain unresolved.
0 responses to “ASOS Data Breach Confirmed After Hackers Send Unauthorized App Alerts”