ASOS customers experienced a significant scare this morning, when the retailer’s mobile application sent out a chilling push notification suggesting that the company had been compromised by hackers. The alarming notification, titled “ASOS HACKED,” was dispatched around 10 AM BST on Tuesday and was directly addressed to the organization itself, rather than its customers. It warned, “Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.” The message included a link to a Telegram channel, and numerous users across different countries reported receiving the distressing alert.
As of now, ASOS has not made any public statement regarding the incident and has not confirmed whether its Snowflake database environment has indeed been accessed or compromised. Downdetector recorded approximately 500 reports of issues starting around 9:40 AM, most of which were related to the app as opposed to the website. Following the notification, ASOS’s share price dropped approximately 5% within 30 minutes, reflecting the swift market reaction to the unsettling news.
Dray Agha, senior manager of security operations at Huntress, expressed serious concern over the implications of the breach. Snowflake, a massive cloud database platform often used by retailers to store sensitive customer information, could hold a wealth of data that, if accessed, poses risks to consumers. Agha emphasized the boldness of the attackers, indicating that the notification illustrates a public extortion tactic meant to pressure the company into quick negotiations.
Muhammad Yahya Patel, who serves as the vCISO and cybersecurity advisor for EMEA at Huntress, added that the method of communication itself is as damaging as any data theft. The attackers utilized ASOS’s own app to relay their message of extortion, showcasing not just a breach of data but also a catastrophic failure in operational control. The reputational fallout from such an incident can be substantial and long-lasting.
The market response underscores a crucial point highlighted by Charlotte Wilson, head of enterprise for the UK and Ireland at Check Point. She noted that if confirmed, the attack constitutes a serious breach because the hackers have audaciously turned ASOS’s own mobile application into their vehicle for a ransom demand. The immediate dip in ASOS’s stock price serves as a stark reminder that cybersecurity threats intertwine closely with corporate performance and reputation. Investors acted quickly, even before ASOS had a chance to clarify the situation.
Wilson pointed out that many consumers inherently trust notifications coming from mobile applications, believing them to originate directly from the companies. The possibility that a malicious actor has managed to hijack such a relationship and directly threaten customers highlights how rapidly a cyber incident can escalate, affecting not only the company but also its market valuation.
The reference to Snowflake invokes memories of a wave of attacks on the cloud data platform’s clients back in 2024, during which stolen credentials were exploited to access corporate accounts. Daniel dos Santos, VP of research at Forescout, made a compelling observation regarding the similarities between past and present attacks involving Snowflake’s customers, although he acknowledged that the methods of initial access remain unconfirmed.
Adding to the urgency of the situation, ASOS has faced account security challenges recently. In August, its US branch alerted customers about unauthorized access to their accounts due to compromised login credentials obtained externally. Although there is currently no evidence linking the two incidents, the overlap in timing raises potential concerns.
The Telegram link embedded within the notification led to a channel named Xuanye Gateway, which appeared to have been created only hours prior to the breach. The emergence of this channel with an already notable number of subscribers indicates that the attackers were not only intent on targeting ASOS but potentially had plans for broader ambitions.
Michele Campobasso, a senior security researcher at Forescout, suggested that the lack of detailed information about the threat actor implies they might be planning further attacks to leverage their newfound visibility. Jamie Akhtar, the CEO and co-founder of CyberSmart, provided insights into the potential scale of the situation, stressing that while the initial concern may revolve around the app’s notifications, the ramifications could extend far deeper into ASOS’s systems, affecting customers, third-party businesses, and the company itself.
Security experts have been vocal about the need for caution. They urge users to avoid clicking links in the notification and to remain vigilant against follow-up scams that may arise in the wake of this incident. Akhtar advised customers to be suspicious of any unexpected communications regarding their ASOS accounts and to check the official ASOS website for legitimate updates.
Javvad Malik, a lead CISO advisor at KnowBe4, reinforced the notion that the unfolding situation could lead to uncertainty and anxiety among consumers, emphasizing the need for ASOS to regain control of the narrative swiftly. Clear communication through verified channels is critical to help mitigate fear and misinformation.
The incident serves as a pertinent lesson for businesses, highlighting the importance of securing third-party access to sensitive data. Akhtar reiterated that companies must remain aware of who can access their data and ensure robust security practices to protect their customers. Wilson encapsulated the overarching message accrued from this episode by stating that cyber-attacks have the power to resonate far beyond the confines of the IT department, impacting customer trust, reputation, and shareholder value almost instantaneously.
As the investigation unfolds, the industry remains on high alert, keenly observing how ASOS navigates this cybersecurity crisis and what it portends for the future landscape of digital commerce security.