The UK retailer said customers’ names and contact details may have been accessed, but it did not believe payment data or passwords were affected. ASOS and Snowflake are investigating.
British online fashion retailer ASOS is investigating unauthorised activity on third-party platforms it uses to communicate with customers. The company opened an inquiry on Oct. 6 after users received an app alert titled “Asos hacked” that directed them to a Telegram account. The company said its website and app continued to operate.
ASOS said customers’ names and contact details “may have been accessed.” It did not believe payment information or account passwords had been affected. The company said it immediately restricted access to its notification platforms and was working with specialists and authorities. ASOS has about 17 million active customers worldwide.
The message sent through the app claimed that attackers had fully compromised the company’s Snowflake cloud environment and urged ASOS to contact them, threatening to leak data. A Snowflake spokesperson told AFP that the company had begun an investigation after learning of the alert and had so far found no compromise of its platform. The investigation is continuing.
ASOS shares initially fell by almost 15% in London before partially recovering; by mid-afternoon they were still down about 10%. Marie Wilcox, market strategy analyst at cybersecurity firm Binalyze, described such alerts as psychological pressure designed to cause panic and push a company toward paying a ransom.
The UK’s National Cyber Security Centre offered ASOS assistance, according to sources. A spokesperson for the Information Commissioner’s Office said the watchdog did not appear to have received a report at that stage. ASOS told shareholders it had cyber insurance but said it was too early to assess any potential effect on trading.
The AFP report also noted that a cyberattack on three Manchester Airports Group airports in August resulted in the theft of personal data belonging to 8.7 million customers. That was a separate incident and is not connected to the ASOS investigation. The company has not confirmed that data was stolen from its systems.