Asos Investigates Unauthorized Notification Sent to App Users by Hackers

Asos is investigating unauthorized activity involving third-party platforms after customers received a notification from its app sent by hackers. Dozens of individuals reported receiving the message labeled "ASOS HACKED" on Tuesday morning, with some expressing concern about using the app. The notification was directed to the company's data protection officer and IT teams, and cybersecurity experts described it as a potential extortion attempt. Asos confirmed the unauthorized notification on Tuesday afternoon, stating that some basic personal information may have been accessed. In an email to customers later that evening, the company apologized and advised against engaging with the notification, assuring that its website and app were operating normally. The company has not yet reported the incident to the UK's Information Commissioner's Office (ICO). The exact number of customers who received the notification is unclear, but the ASOS app has been downloaded over 10 million times on Android devices. Reports indicate that users in Australia, France, Sweden, and the Republic of Ireland also received the notification. Shares in Asos fell by approximately 10% on Tuesday. Charlotte Wilson, head of enterprise at cybersecurity firm Check Point, characterized the attack as serious, noting that hackers appeared to have used Asos's app to send their ransom note. She advised customers to change their passwords and remain cautious of potential scam communications. The notification appeared on users' home screens around 10:00 BST on Tuesday, stating, "We have fully compromised the Snowflake instance. Engage with us, or we will leak it," and included a link to a Telegram channel. Users expressed confusion and concern regarding the implications for their personal data. Asos stated it took immediate action to restrict access to the notification platforms and is collaborating with specialists and relevant authorities. The company believes that payment-card information and account passwords were not affected. The National Cyber Security Centre has offered assistance to Asos. Snowflake, the platform mentioned in the notification, reported no compromise of its services thus far. Cybersecurity experts indicated that the hackers likely aimed to pressure Asos rather than directly target its customers. Asos customers are advised not to click on links in the notification and to monitor their online transactions for unusual activity.