Asos confirms customer data breach after hackers send rogue app notification

UK fashion retailer Asos has confirmed a breach involving customers’ personal information after hackers used the company’s app to send users an unauthorised notification.

In a filing with the London Stock Exchange, Asos said hackers accessed a third-party platform that hosts data the company uses to communicate with customers. The company said names and contact information were taken. BBC News reported that the stolen data also includes home addresses, phone numbers, email addresses and notes about customer profiles, including website search queries.

The notification addressed Asos’ data protection officer and IT department and claimed hackers had “fully compromised” company data hosted on Snowflake. It threatened to leak the data unless Asos engaged with the hackers. The group, which uses the name Xuanye Group, has not said how much data it claims to have.

Bleeping Computer reported that the hackers gained access to the Snowflake instance by impersonating a trusted contact to obtain login credentials. Snowflake said its systems had not been breached. It is unclear whether Asos’ Snowflake instance used multi-factor authentication, or how the hackers accessed the system for sending in-app notifications.

Asos has 17 million customers, according to its website. The source also notes a separate earlier breach at fintech company Betterment, where hackers used access to a third-party marketing platform to impersonate the company and send customers a crypto scam.