ASOS app users notified by hackers about personal data breach

UK-based fashion retailer ASOS is investigating unauthorised access to its online app after thousands of shoppers received a notification claiming hackers had fully compromised its systems. The retailer confirmed that basic personal information, including customer names and contact details, may have been accessed by a third party. However, it stated that payment card details and passwords were not compromised, and operations across its website and app continue without disruption.

The notification directed users to the Telegram messaging platform, where the threat actors identifying themselves as the Xuanye Group claimed to have fully compromised the company's Snowflake instance, a cloud service used for data processing and push notifications. The group noted that customer information is being held on its servers for a limited period while confirming payment data was unaffected. Asos, which maintains cybersecurity and business continuity insurance, restricted access to the notification platforms, engaged specialist advisers, and received support from the National Cyber Security Centre (NCSC).

The incident caused Asos shares on the London Stock Exchange to fall more than 14% before recovering to an 11% decline.

Training Announcement: The BCS Practitioner Certificate in Information Risk Management (PCIRM) is an advanced-level programme for data specialists who actively monitor and minimise the risk of cyberattacks, information security incidents, and data protection violations. Find out more.