Asos is investigating an unauthorised access to its app system following notifications to customers that hackers had 'fully compromised' the company's data. The company stated that personal data, including names and contact details, may have been accessible to an unidentified third party.
As stated, the company does not believe that payment card data or passwords were compromised. The company added that it has taken immediate steps to restrict access to notification platforms and is cooperating with internal and external specialists, as well as relevant authorities. According to the statement, the website and app are operating normally, with no current disruptions to business operations.
Asos's shares on the London Stock Exchange fell by more than 14 per cent, before recovering to a level 11 per cent lower. The company stated it has cyber security insurance with a major provider, including business continuity insurance, but warned: 'It is too early to quantify any potential impact on trading.'
Thousands of customers received a notification titled 'Asos hacked' with a link directing them to Telegram. The message sent to customers read: 'Dear As DPO [data protection officer] and IT, we have fully compromised the Snowflake instance.' Snowflake is a cloud platform used for storing, processing, and analysing data, including transaction data and demographic information such as clothing sizes and body measurements. The platform also allows the sending of push notifications to phones.
The Telegram channel, led by hackers calling themselves the Xuanye Group, contained a message assuring As customers that payment data was not affected. The channel also posted a message stating that the 'app is safe to use', with the claim: 'The incident involves customer data, which is safe on our server and will not be tampered with for a certain period.'
The National Cyber Security Centre, part of the government's intelligence agency, is offering assistance to As. Dray Agha, senior manager of security operations at online security firm Hunt, and Aiden Sinnott, lead threat researcher at cyber security firm Sophos, along with Marius Briedis, chief technology officer at online service provider Nord, are cited as experts in the context of this incident. Xu had not previously been mentioned on hacker forums or other Telegram channels.
The potential attack follows a series of cyber incidents affecting British retailers, including Marks & Spencer, Co-op, and Harrods. M and S and Co-op experienced shortages of stock, with M being forced to close its website for several weeks.
