Asos hit by extortion hack that may have compromised some customer data
The attackers sent a push notification to Asos shoppers announcing their activity.
Extortion Push Notifications
UK-based fashion retailer Asos is doing damage control after its customers were sent a push notification claiming that its cloud services had been hacked. According to reports, Asos users received mobile alerts that were addressed to the company's data protection officer and IT personnel.
The notifications read that the Snowflake instance had been fully compromised, demanding engagement or threatening a data leak. Snowflake is a cloud service that handles push notifications as well as managing data about transactions and customer demographics. A link in the message sent users to a Telegram channel claiming to be operated by an external group.
Company Response
According to the company's statement, Asos is investigating unauthorized activity involving third-party platforms used to communicate with customers. The firm took immediate action to restrict access to the notification platforms and is working with internal and external specialist advisers, as well as relevant authorities.
Asos stated that although customers' names and contact information may have been accessed in the hack, it did not believe payment details or passwords had been compromised. The company added that its app and website were operating as usual.
