Asos Investigates App ‘Hack’ Alerts as Shares Fall 12%

Asos is investigating whether hackers accessed its systems after thousands of customers received a push notification through the retailer’s own app titled “Asos hacked”, according to Theguardian. The alert directed recipients to a message on the Telegram messaging service.

The notification read: “Dear ASOS DPO [data protection officer] and IT, we have full compromised the Snowflake instance. Engage with us, or we will leak it,” followed by the Telegram link. Asos shares dived almost 12% on the London Stock Exchange, later trading down 13.3%, making them the biggest faller on the FTSE 250 index. The website and app appeared to keep operating on Tuesday morning, and it is understood the company is still investigating whether any hack occurred.

Also read: Nike Posts Mixed Quarter and Reveals Layoffs in Pace Overhaul

Key facts

• The notification was sent to thousands of Asos app users on Tuesday and was titled “Asos hacked”.
• The message told Asos’s data protection officer and IT team it had “full compromised the Snowflake instance”.
• Asos shares fell almost 12%, later widening to 13.3%, the biggest decline on the FTSE 250.
• Snowflake is a cloud platform used to store, process and analyse data including transactions and demographic information such as clothing sizes and body measurements.
• Marks & Spencer, the Co-op, Harrods and carmaker Jaguar Land Rover have all been targeted by cyber attackers over the past two years.

What security researchers say about the Asos alert

Dray Agha, senior manager of security operations at the online security firm Huntress, said Snowflake is a large cloud database where retailers typically keep sensitive customer information, and called the incident “clear public extortion”. He advised shoppers to watch for targeted phishing attempts while awaiting official confirmation of a breach.

Marijus Briedis, chief technology officer at NordVPN, described the notification as unusually brazen, noting that a message apparently written for Asos’s data protection and IT teams was pushed straight to customers through the company’s own app. He said customers should not assume their personal or payment details have been taken, and urged them to reach the Asos site or app through their own bookmarks rather than links in unexpected messages.

Also read: Kroger has closed at least 39 stores across 9 banners as part of its 60-store overhaul

Tatyana Shishkova, lead security researcher at the anti-virus provider Kaspersky, said attackers able to reach people through a trusted channel can quickly undermine confidence, and warned organisations against drawing conclusions from cybercriminals’ own claims. Recent Kaspersky investigations, she said, show criminals increasingly relying on misconfigurations and legitimate tools already inside a company’s environment.

Why it matters

For Asos, the commercial exposure runs alongside the technical question. Customers grant a retailer access to their phone lock screens because they trust it, and reusing that channel to deliver a threat undermines genuine messages too. Marty Bauer, ecommerce expert at the software company Omnisend, noted that push automations had a 22.9% conversion rate last year among brands using its platform, and said switching notifications off or disengaging could hit repeat sales.

The timing adds pressure. Black Friday is approaching, and Asos is midway through a turnaround programme as it tries to reverse a sales decline and return to profit. The company, which owns Topshop and Miss Selfridge, has 17 million customers in more than 150 countries and employs 2,800 people, with the UK accounting for 49% of first-half revenue.

The incident follows a run of attacks on British retailers. Marks & Spencer and the Co-op suffered stock shortages, and M&S closed its website for several weeks while cleaning its systems.

What to watch

The coming days will show whether Asos confirms a data breach and what its forensic investigation finds about how the notification was sent. Customers should treat unexpected emails or texts claiming to be from Asos with suspicion until the company reports back.

Asos has not published guidance on future earnings or risk exposure tied to this incident, and nothing here should be read as financial advice. Equity markets are volatile and share prices can move sharply on unverified claims.

Written by

Benjamin

Benjamin Carter covers business, finance, and the stock market for StockPil, focusing on the trends and data that matter to everyday investors.

Source: The Guardian