ASOS Hackers Accessed Employee Account to Send Rogue Push Notifications
Investigation reveals attackers used a compromised employee account to distribute malicious push notifications, accessing limited personal data.
Key points
- Attackers accessed an employee account to send rogue push notifications
- Some personal information, including names and contact details, was accessed
- ASOS conducted the investigation with the assistance of external experts
Online fashion retailer ASOS confirmed that hackers successfully compromised an employee account to distribute rogue push notifications to users. The company stated that its investigation, conducted alongside external security experts, determined that attackers accessed limited personal and non-personal account information.
The breach involved a specific vector where the threat actors tricked their way into a staff member’s account. Once inside, they leveraged this access to send unauthorized push notifications. According to The Record, the company’s findings indicate that the attackers obtained some personal information, specifically names and contact details, along with certain non-personal account-related data. ASOS has not publicly detailed the specific technical method used to trick the employee, nor has it released the exact timeline of the initial compromise.
Context and Background
The incident highlights the ongoing risks associated with social engineering and credential compromise within enterprise environments. By targeting an employee account rather than directly breaching the customer-facing database, attackers were able to bypass certain perimeter defenses. The use of push notifications as a delivery mechanism for malicious activity is a growing concern in the mobile security landscape, as users often trust notifications originating from installed applications.
ASOS engaged external experts to assist in the forensic analysis of the breach. This collaboration allowed the company to identify the scope of the data accessed and the method of entry. The Record reported that the investigation concluded with the identification of the specific data types compromised. The company has not indicated whether the attackers established persistence within the network beyond the initial employee account compromise.
Who Is Affected
Customers whose accounts were accessed during the incident may have had their names and contact details exposed. ASOS specified that the data accessed included "some personal information" and "certain non-personal account related information." The company did not confirm whether payment card details, passwords, or other sensitive financial data were accessed. The scope of the breach is limited to the information available within the compromised employee account and the specific accounts targeted by the rogue push notifications.
Users who received the rogue push notifications are advised to review their account activity. While ASOS has not confirmed a widespread data exfiltration event, the exposure of names and contact details poses a risk for phishing and social engineering attacks. The company has not provided a specific list of affected users or a detailed breakdown of the number of accounts impacted.
What should you do?
ASOS has not confirmed the release of a specific patch or software update to address this vulnerability. Users should monitor their accounts for any unauthorized activity. If you received a suspicious push notification from the ASOS app, do not click on any links or provide any information. Change your password for your ASOS account and any other accounts where you reuse the same credentials. Enable multi-factor authentication if it is not already active. Monitor your email and contact information for signs of phishing attempts, as attackers may use the exposed names and contact details to craft targeted scams.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
Frequently asked questions
What data was stolen in the ASOS hack?
Attackers accessed some personal information, including names and contact details, and certain non-personal account-related information.
How did the hackers gain access to the system?
The hackers tricked their way into an employee account, which they then used to send rogue push notifications.
Is there a fix for this vulnerability?
No specific fix or patch has been confirmed by ASOS for this incident.
