ASOS: Hackers tricked way into employee account before sending rogue push notification

UK fashion retailer Asos has disclosed a data breach affecting its customers' personal data after hackers leveraged the company's own application to alert users of the compromise. The breach was disclosed in a filing with the London Stock Exchange, revealing that hackers infiltrated a third-party platform that hosts data Asos utilizes to communicate with customers.

The stolen information encompasses names, contact details, home addresses, phone numbers, email addresses, and customer profile notes, including search queries on Asos' website. The hackers transmitted an unauthorized customer notification via the app, which many users disseminated on social media platforms. The notification addressed Asos' data protection officer and IT department, asserting that the hackers had "fully compromised" Asos' data stored on Snowflake, a technology firm enabling corporate users to analyze extensive data sets.

The message read, "Engage with us, or we will leak it." By utilizing the app's notification system to alert customers, the hackers aimed to coerce Asos into collaborating with them or face the potential publication of the stolen data online. The hackers reportedly gained access to Snowflake by impersonating a trusted contact to obtain login credentials.

Snowflake asserted that its systems remained unbreached. It remains uncertain whether the Asos-operated Snowflake instance was safeguarded with multi-factor authentication. It is unclear how the hackers obtained access to Asos' system for dispatching in-app push notifications, which are commonly managed by a third-party service.

The hackers, known as the Xuanye Group, have not disclosed the quantity of data they allegedly possess. Asos maintains 17 million customers, according to its website. Earlier this year, fintech giant Betterment fell victim to hackers who exploited their access to the company's third-party marketing platform to impersonate Betterment and disseminate a crypto scam to its customers, acquiring names, email addresses, phone numbers, and other data during the breach.