Online fashion retailer ASOS has provided an update on its investigation into a cyber security incident that saw its customers from around the world – including Australia – receiving a message from the hacker over the company’s smartphone app.
ASOS said it was investigating the incident in an October 6 filing to the London Stock Exchange, confirming the unauthorised message and suggesting that “Basic personal information including name and contact details may have been accessed” by the hacker, which calls itself the Xuanye Group.
The company said its investigation remains ongoing, but has confirmed what the hacker already said on its Telegram channel: the incident has not impacted customer passwords or credit card information.
Some customer data, however, has been compromised.
“Our investigation found that the unauthorised party had access to some personal information, including names and contact details, and certain non-personal account-related information,” ASOS said.
The company told customers that they do not need to take any action; however, ASOS urged customers to remain cautious.
ASOS’ update also outlined how the incident occurred.
“We discovered that an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain login credentials. Those credentials were then used to access information on certain third-party platforms used by ASOS,” the company said.
“The affected platforms were immediately locked down, ensuring that no further information could be accessed and a full investigation was launched with the support of both internal and external cyber experts. We are also working with the relevant law enforcement and regulatory authorities.”
ASOS said that once its investigation is complete, it will begin contacting customers whose data has been compromised.
Despite passwords and credit data being unaffected, the data potentially stolen by the threat actor could still prove useful for further malicious activity targeting ASOS customers, Trevor Dearing, Director of Critical Infrastructure Solutions at Illumio, told Cyber Daily.
“With the stolen information, attackers have detailed information about ASOS customers that they can use to tailor scams to individuals, rather than relying on the generic texts and emails we typically receive,” Dearing said.
“Passwords have not been stolen, so be highly suspicious of any unsolicited text or email asking you to change or share yours. Expect scammers to mention the attack, use your personal details to seem genuine, and create urgency, such as threatening to lock your account within 24 hours.”
Dearing added that if customers do wish to change their passwords, they should do so directly via the ASOS app or website.
“ASOS now has a lot of work to do to win back customers' trust, likely much more than the retailers hit last year,” Dearing said.
“For online-only retailers, and any organisation, the focus must be on containing attacks so that critical systems and sensitive information can never be accessed."
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
