Asos Admits Cloud Data Breach After Hackers Alert Users via Push Notification
The online retailer confirmed customer data was exposed after attackers sent a notification claiming full access to its cloud infrastructure.
Key points
- Asos confirmed a breach of customer data following a hacker alert.
- Attackers used a rogue push notification to inform customers of the compromise.
- The hackers claimed to have fully compromised the company’s cloud storage.
Online fashion retailer Asos has confirmed that customer data was breached after hackers sent a direct notification to users claiming they had fully compromised the company’s cloud infrastructure, according to a report by TechCrunch.
The disclosure came after the threat actors bypassed standard communication channels to alert the affected individuals directly. Instead of waiting for a formal press release or security advisory, the hackers utilized the retailer’s own push notification system to broadcast a message stating they had achieved total access to Asos’s cloud storage environment. This unusual method of disclosure forced the company to address the incident publicly.
The Nature of the Attack
The incident highlights a significant security failure in the retailer’s notification systems. By sending a rogue push notification, the attackers demonstrated not only access to the underlying data stores but also control over the mechanisms used to communicate with customers. The notification explicitly stated that the hackers had "fully compromised" the cloud storage, a claim that Asos has now validated by confirming the breach of customer data.
TechCrunch reported that this direct-to-user alert was the primary catalyst for the public confirmation. The attackers’ ability to manipulate the notification service suggests a deep level of infiltration within the company’s digital ecosystem. The specific technical vector used to gain this access was not detailed in the initial reporting, but the outcome indicates a severe lapse in cloud security controls.
Who Is Affected
The breach impacts Asos customers, whose data was stored in the compromised cloud environment. The hackers’ notification served as both a proof-of-concept and a warning to the affected users that their information had been accessed. Asos has acknowledged the exposure but the specific types of customer data involved—such as payment details, personal addresses, or login credentials—were not enumerated in the immediate reports from TechCrunch.
Customers who received the push notification are the primary group identified in the breach notification process. The scope of the data exposure remains under investigation, but the confirmation of a cloud storage compromise implies that a wide range of stored customer information could be at risk.
What should you do?
Security professionals and affected customers should monitor for further disclosures regarding the specific data types exposed. Organizations using similar cloud architectures should review their notification system access controls to prevent unauthorized broadcasting. Users should remain vigilant for phishing attempts that may leverage knowledge of the breach.
What to do and how to stay safe: Asos
- Monitor your Asos account for any unauthorized changes or suspicious activity, and report anomalies to customer support immediately.
- Change your password for Asos and any other accounts where you reused the same credentials, ensuring the new password is unique and complex.
- Enable multi-factor authentication on your Asos account and other critical services to add an extra layer of security against credential theft.
- Review bank and credit card statements for any fraudulent charges, and consider placing a fraud alert with credit bureaus if financial data was potentially exposed.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did hackers send the breach notification directly to customers?
Yes, according to TechCrunch, hackers used a rogue push notification to alert Asos customers that their cloud storage had been compromised.
Has Asos confirmed that customer data was breached?
Yes, Asos has confirmed that customer data was breached following the hacker notification.
What did the hackers claim they accessed?
The hackers claimed in the push notification that they had fully compromised Asos’s cloud storage.
