ASOS Users Got a Very Unwelcome Push Notification: "ASOS HACKED"
A hacking group calling itself Xuanye sent fake push alerts through ASOS's app claiming a full data breach. The retailer says names and contact details may be exposed, but little else is confirmed.
ASOS confirmed this week that "third-party platforms used to communicate with customers were accessed without authorization," after users began receiving unauthorized push notifications through the retailer's app early Tuesday morning. One alert read "ASOS HACKED" and claimed the sender had compromised ASOS's Snowflake data instance, threatening to leak customer data unless the company engaged.
The alerts pointed to a Telegram channel run by a group calling itself "Xuanye," which later posted what it called a "FINAL STATEMENT" claiming it had stolen customer information, without specifying what data or how many accounts were affected. ASOS says it believes basic personal information, like names and contact details, may have been exposed, but that payment card numbers and account passwords were not affected. The company has told customers to ignore the rogue notification and posted an in-app warning not to click its link.
Nothing about the Snowflake claim has been independently confirmed, which puts ASOS in the increasingly familiar position of managing a PR crisis before anyone, including the company itself, actually knows the scope of the breach.
Source: Bleeping Computer
Kyle Duford, Founder & Editor, BRNDWIRE. More from Kyle →
