Asos Investigates App Notification Claiming Hack as Shares Fall Almost 12%
Asos is investigating a push notification that told customers hackers had “fully compromised” its data, as shares fell almost 12% on the London Stock Exchange. The retailer’s app and website appeared to still operate while it checked whether a breach occurred.
Asos shares fell almost 12% on the London Stock Exchange after the notification was received. The website and app appeared to be continuing to operate on Tuesday morning, and Asos was still investigating whether any hack had taken place, The Guardian reported. TechRadar also reported that customers had received a threatening notification from hackers.
The message sent to customers said: “Dear ASOS DPO [data protection officer] and IT, we have fully compromised the Snowflake instance.” Snowflake is a cloud platform used to store, process and analyse data including transactions and demographic information, such as clothing sizes and body measurements. It also enables push notifications to clients’ phones, according to The Guardian.
Dray Agha, senior manager of security operations at the online security firm Huntress, said Snowflake is a massive cloud database where retailers typically store sensitive customer information, and that it would be a real worry if cyber criminals had accessed it as they claim. He said the push notification suggested attackers had breached the systems controlling the Asos mobile app as well, calling it clear public extortion. Sending a ransom demand directly to consumer devices is an aggressive extortion tactic designed to force the business into a quick negotiation, he said, advising shoppers to watch out for targeted phishing attempts while waiting for official confirmation of a data breach.
Marijus Briedis, chief technology officer at the online service provider NordVPN, said customers should be particularly alert to what happens next because high-profile cyber incidents create ideal conditions for phishing attacks. He said criminals may exploit the publicity by sending emails and texts claiming to be from Asos, perhaps asking customers to reset a password, confirm payment details, check an order or claim a refund.
The potential hack comes after a string of British retailers including Marks & Spencer, the Co-op and Harrods suffered cyber incidents last year. Marks & Spencer and the Co-op experienced stock shortages, and Marks & Spencer was forced to close its website for several weeks as it battled to ensure its systems were clean.