Asos Plc said the data breach earlier this week was carried out by an unauthorized party who posed as a trusted to deceive an employee into giving up the login credentials for their work account. The company disclosed the method of the attack on Thursday in an update to customers, according to Bloomberg.
The hackers, who call themselves the Xuanye Group, used those credentials to gain access to third-party platforms Asos uses to communicate with customers, the company said. Asos said access to those platforms has since been secured and the company has opened a full investigation into the incident. Asos said its website and app remain safe to use.
The breach exposed some customer personal information, including names and details. Asos said it does not believe payment card information or account passwords were affected. The U.K. Information Commissioner's Office has been notified and is assessing the situation, according to Bloomberg.
Asos shares climbed as much as 5.3% in London on Thursday, with investors appearing reassured that the scope of the attack was narrower than early reports had indicated, according to Bloomberg.
The incident began Tuesday, when customers received an unauthorized push notification through the Asos mobile app. In the message, the hackers asserted they had fully compromised Asos's Snowflake $SNOW system, a cloud-based data storage platform, and pointed recipients toward a Telegram channel the Xuanye Group controls, according to Bleeping Computer . Snowflake Inc. denied that its platform had been compromised, a spokesperson told Bloomberg.
The Xuanye Group first appeared on Telegram in early September, according to Bloomberg, citing Anastasia Tikhonova, global head of threat research at cybersecurity firm Group-IB. Tikhonova told Bloomberg the group cycled through earlier usernames before settling on @xuanyegroup on October 6, the same day it took credit for the attack on Asos. Before that point, the account showed no history of cybercriminal activity and had been used mainly to trade items within online gaming communities, Tikhonova told Bloomberg.
The incident is the latest in a series of cyberattacks targeting British retailers. Marks & Spencer Group Plc suffered significant operational disruption last year when a cyberattack compelled the retailer to halt online orders for clothing and goods, according to Bloomberg.
The U.K. National Cyber Security Centre advised all Asos customers to assume their data was affected, even those who did not receive the unauthorized notification. It recommended customers watch for suspicious messages, avoid clicking unfamiliar links, and use strong, separate passwords with two-step verification.
Asos said it has cybersecurity insurance, including business continuity coverage, and that it is too early to quantify any potential impact on trading.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
