Fashion · London
ASOS Confirms Cyber Attack After an Unauthorised 'Hacked' Notification Reached Customers' Phones
ASOS says customer names and contact details were accessed; payment cards and passwords are not believed affected. TFG London has reported an incident too.
ASOS has confirmed a cyber attack after customers received an unauthorised notification through its app. The message, which arrived on Tuesday 6 October, was titled 'Asos Hacked', claimed the Snowflake platform was 'fully compromised', threatened to leak information and linked to a new Telegram channel, attributing the attack to a group calling itself Xuanye, FashionUnited reported.
In a statement on Thursday 8 October ASOS said the notification came from activity involving third-party platforms used to communicate with customers, that it had restricted access to the affected platforms, and that it was investigating with internal and external cybersecurity specialists and the relevant authorities. TheIndustry.fashion reported the company's account that an unauthorised party had impersonated a trusted contact to obtain an employee's login credentials.
What was and wasn't accessed
- Names and contact details 'may have been compromised', and ASOS has said certain non-personal account-related information was accessed.
- ASOS said it does not believe payment-card information or account passwords were involved.
- ASOS has not confirmed that its Snowflake set-up was accessed, and has not given a figure for the number of customers affected.
The website and app remain operational with no current trading disruption, ASOS said; it has cyber security and business continuity insurance and said it was too early to assess any impact on trading. Its shares fell around 11% in morning trading, from about 500p to 433p, and recovered to roughly 460p, FashionUnited reported.
It is not only ASOS
FashionUnited reported on 14 October that TFG London, the group behind Hobbs, Whistles and Phase Eight, said some of its IT systems were affected: stores are trading normally, some website functions are unavailable, and it does not believe payment data was affected. H&M told the BBC it had found no sign that its data environment was compromised.
None of the sources reviewed names a regulator, and the number of affected customers was unconfirmed at the time of writing.