Asos confirms customer data breach after hackers hijack its app

The online fashion retailer Asos has confirmed a breach of its customers' personal data, after hackers used the company's own app to tell users that it had been compromised.

In a statement to the London Stock Exchange, Asos said hackers had broken into a third-party platform holding data it uses to communicate with customers. It said names and contact information had been taken.

BBC News reported that the stolen data includes home addresses, phone numbers and email addresses, as well as notes linked to customer profiles, such as searches made on the website.

"Engage with us, or we will leak it"

Many customers posted on social media about an "unauthorised customer notification" sent through the Asos app. The message was addressed to Asos's data protection officer and IT department, and claimed the hackers had "fully compromised" the company's data held on Snowflake, a cloud service that companies use to store and analyse large amounts of data.

"Engage with us, or we will leak it," the notification said. By using the app's own alert system, the hackers appear to be trying to pressure Asos into negotiating, under threat of the data being published online.

How they got in

The technology news site Bleeping Computer reported that the hackers got into the Snowflake account by "impersonating a trusted contact to obtain log in credentials". Snowflake said its own systems had not been breached. It is not known whether the account was protected by multi-factor authentication, or how the hackers got access to the system Asos uses to send app notifications.

The group, which calls itself Xuanye Group, has not said how much data it holds. Asos says it has 17 million customers.

What customers should do

• Be on guard for phishing: criminals may use stolen names, addresses and phone numbers to send convincing fake emails, texts or calls claiming to be from Asos, a bank or a delivery company.
• Do not click links in unexpected messages. Go to the Asos website or app directly instead.
• Asos has not said that passwords or payment card details were taken, but it is good practice to use a unique password for every account and to turn on two-step verification where it is offered.
• Report suspicious messages: forward scam emails to report@phishing.gov.uk and scam texts to 7726.

Your rights

Under UK data protection law, companies must report serious personal data breaches to the Information Commissioner's Office within 72 hours of becoming aware of them, and must tell affected customers without undue delay when there is a high risk to them. Customers can ask Asos what information it holds about them.

A growing tactic

Hijacking a company's own messaging tools to contact customers is becoming more common. Earlier this year, hackers who broke into a marketing platform used by the US investment firm Betterment used it to send customers a cryptocurrency scam.

The attack is the latest in a run of cyber incidents affecting well-known British retailers, which have shown how much damage a single compromised supplier or account can cause.