Asos Hackers Duped Employee in Data Breach Incident

Asos says threat actors duped employee to breach systems

Hackers behind a threat to publish customer data belonging to Asos accessed internal systems by impersonating a trusted contact to trick an employee, the online fashion retailer said on Thursday.

The group sparked alarm among millions of shoppers on Tuesday after issuing an unauthorized push notification through the official Asos mobile app. The message stated that the hackers had compromised the retailer's systems and threatened to leak customer information.

News of the security incident caused an immediate sell-off in London, sending shares in the FTSE 250 business down more than 13 per cent as investors questioned the potential impact on its corporate turnaround plan.

In its first direct communication to shoppers since the breach, Asos apologised for the uncertainty caused by the event and provided details of an ongoing investigation.

"We discovered that an unauthorised party gained access to an Asos employee account by impersonating a trusted contact to obtain login credentials," Asos said in a statement. "Those credentials were then used to access information on certain third-party platforms used by Asos."

The online retailer said it locked down its systems immediately to prevent additional unauthorized activity and referred the matter to law enforcement and regulatory authorities.

Management assured shoppers that payment details and account passwords were not accessed during the intrusion. However, the intruders did obtain personal data, including names and contact details.

"Once our investigation is complete, we will contact customers directly where we believe additional information, support or action may be required," the company said. "We know our customers trust us with their information. We take that responsibility seriously and have already taken additional steps to further strengthen security controls. Thank you for your patience and for continuing to put your trust in us."

Cloud platform notifications

Following the update from management, shares in Asos recovered part of their earlier losses, rising four per cent to 469p.

Shoppers were first alerted to the security failure on Tuesday when a pop up notification appeared on their mobile screens reading: "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it."

Snowflake, a cloud platform used by companies to store and manage operational data such as body measurements and clothing sizes, also handles user push notifications for mobile devices.

Snowflake rejected claims that its enterprise systems were breached. A company spokesperson stated on Tuesday that internal reviews revealed no compromise of its platform.

The app notification provided a direct link to a channel on the Telegram messaging service. A user operating under the name 'Xuanye Group' claimed to possess customer records that were safe on their servers and would remain untouched for a designated period.

"Considering the current situation regarding incident disclosure in the cyber security landscape, you can thank us for our generous clarity regarding this incident," the message read.

Social engineering and phishing attacks have targeted multiple British retailers in recent years. IT personnel at Marks and Spencer were tricked by hackers who obtained unauthorized system access in a similar manner last year.

The incident occurs while Asos continues a multiyear operational restructuring led by chief executive José Antonio Ramos Calamonte. The company recently reported that it remained on track to achieve its gross margin target of 48 to 50 per cent, alongside forecast adjusted earnings between £150m and £180m.

Commenting on the breach, Bloomberg Intelligence analyst Charles Allen noted that the event may temporarily cap the pace of the company's operational recovery, adding that any loss of customer trust could weigh on efforts to rebuild its active client base.

Source: City A.M.