Online fashion giant Asos is currently investigating a security breach after its app notification system was accessed by an unidentified third party. The intrusion resulted in thousands of customers receiving a message titled “Asos hacked,” which contained a link redirecting users to a Telegram channel. Shares in fashion company fall nearly 10% after its app systems are accessed by ‘unidentified third party’.
Asos confirmed that basic personal information, such as names and contact details, may have been exposed. However, the retailer stated it does not believe that passwords or payment card records were compromised during the incident. The company is now working with internal and external security advisers, as well as relevant authorities, to resolve the situation. The post added: “The incident involves customer information, it is safe on our server, and it will not be touched for a designated period.”, indicating that Asos had been set some form of deadline. And if the situation changes an update will be provided as appropriate.”, customer trust is incredibly important to us.
The notification sent to users claimed that the “Snowflake instance” had been “fully compromised.” Snowflake is a cloud-based platform used by the retailer to manage data, including transaction records, demographic details, and body measurements, while also powering its push notification service. The hackers, identifying themselves as the “Xuanye Group,” asserted via their Telegram channel that payment information remained secure and that the app itself was safe to use. It also enables push notifications to phones. According to cyber experts, They had not heard of the group before and the push notification could be an attempt to grab wider attention.
The breach has had a tangible effect on the company’s market performance. Asos shares on the London Stock Exchange dipped more than 14% following the incident, ultimately closing down 9.56%. While the retailer disclosed that it holds cybersecurity and business continuity insurance with a global provider, it noted that it is currently too early to quantify the full financial impact on trading.
Assistance is being provided by the National Cyber Security Centre, an agency within GCHQ. Experts warn that this event creates significant risks for consumers. Dray Agha of security firm Huntress described the act of sending ransom demands directly to customer devices as an “aggressive extortion tactic” intended to force a rapid corporate response.
Cybersecurity specialists are monitoring the situation, though the identity of the Xuanye Group remains unclear. Aiden Sinnott from Sophos noted that new threat groups often wait for high-profile opportunities to enter the landscape with perceived credibility, adding that this group had not previously been observed on hacker forums.
Experts at NordVPN have cautioned customers to remain vigilant against phishing attempts. Chief technology officer Marijus Briedis warned that criminals often exploit such publicity to impersonate retailers, sending emails or texts designed to steal credentials or financial information by prompting users to reset passwords or confirm account details. I strongly advise shoppers to watch out for targeted phishing attempts while we wait for official confirmation of a data breach.”.
Asos has assured customers that its primary website and app continue to function as normal with no operational disruptions. The company maintains that it took immediate action to restrict access to its communication platforms and will provide updates if the circumstances surrounding the data breach change. “Our website and app are operating as normal, with no current disruption to any aspects of our operations.
This incident adds to a series of cyber challenges facing the British retail sector, following similar security events last year involving firms such as Marks & Spencer, the Co-op, and Harrods. In some of those cases, companies faced temporary stock shortages or were required to temporarily shutter websites to sanitize their internal systems. M&S and the Co-op experienced stock shortages and the former was forced to close its website for several weeks as it battled to ensure its systems were clean.
