ASOS - One Phished Login, a Hijacked Push Notification, and the Marketing Tools Nobody Was Watching

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

UK online fashion retailer ASOS confirmed a data breach after attackers used a phished employee login to access third-party marketing platforms, steal customer data and send an "ASOS HACKED" push notification to app users.

Timeline (UK time). Tuesday 6 October, ~10:00 — push notification sent through the ASOS app linking to a Telegram channel for "Xuanye Group"; shares fall up to ~13% intraday and close down ~10%; ASOS files a London Stock Exchange update and restricts access to its notification platforms; the NCSC tells customers to assume they are affected. Wednesday 7 October — statement from the UK Information Commission (formerly the ICO); attackers send the BBC a data sample. Thursday 8 October — ASOS emails customers explaining the attack route.

How it happened. Per ASOS: an unauthorised party gained access to an employee account "by impersonating a trusted contact to obtain log in credentials", and used them to access "certain third-party platforms used by Asos". No CVE involved. Snowflake says the incident "was not caused by Snowflake" and no compromise of its platform was found.

What was taken. Per ASOS: names, contact details and some non-personal account information. Per the BBC: names, addresses, phone numbers, emails, customer numbers and dates of birth, plus on-site search terms in the attackers' sample; ASOS told customers profiles of potentially millions of users were taken. Payment cards and passwords not affected, per ASOS. Exact customer count not disclosed.

Unverified claims. Xuanye Group's claims to have "fully compromised" Snowflake (denied), to have entered via Simon AI, and to want a ransom by a two-week deadline are all unverified. Attribution unknown.

Lessons. Treat marketing and customer-messaging platforms as critical systems: inventory them, put them behind SSO and MFA, and restrict who can message every customer. Use phishing-resistant MFA and help-desk identity checks. Prepare a holding statement for an attacker-driven disclosure. Warn customers what follow-up scams will look like.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: ASOS LSE announcement and customer email (via SecurityWeek, The Record, City AM); BBC; UK NCSC; UK Information Commission; Snowflake (via Infosecurity Magazine); Help Net Security; Malwarebytes; ACS Information Age; Hackread.