ASOS appears to be the latest retailer to be targeted by a cyber-attack. Some customers reported receiving a pop-up message this morning (6 October) purporting to be from hackers, stating that they have “fully compromised the Snowflake instance” and warning ASOS to engage with them or they will leak it.
Snowflake is a data storage company, and the hackers appear to be threatening to leak ASOS customer data. However, at the time of writing, neither ASOS nor Snowflake had yet commented on the incident or clarified exactly what is meant by “the Snowflake instance.”
Cyber-security expert Jen Ellis told the BBC that it is “virtually unheard of” for hackers to use pop-ups in this way. The ASOS chatbot has said that the company is looking into the incident and advised users not to click on any links in the pop-up.
How genuine is this?
While it’s not yet known whether this was a genuine threat, Marie Wilcox, VP of market strategy at cybersecurity platform Binalyze, described the attack as “psychological warfare” designed to pile pressure onto ASOS so that they pay up rather than “taking time to develop a rational response.”
“The next few hours are crucial,” she said. “ASOS cannot let panicked pressure dictate its response. The priority must be investigation, and closing the gap that allowed this mass notification to go out. Activity like this will surely have huge noise around it that leaves a clear trail, so there should be plenty of evidence of what happened and how to fix it.”
Dray Agha, senior manager of security operations at enterprise-grade cybersecurity platform Huntress, confirmed Wilcox’s view that the hackers are trying to force ASOS into a quick deal, but said the incident could be very serious for the retailer.
“Snowflake is a massive cloud database where retailers typically store sensitive customer information, a real worry if cyber criminals have indeed accessed it as they claim,” he said. “The push notification suggests attackers have breached the systems controlling the ASOS mobile app also…I strongly advise shoppers to watch out for targeted phishing attempts while we wait for official confirmation of a data breach.”
Reputational fallout
ASOS is already experiencing reputational and financial fallout from the potential data breach; shares in the company fell 5% within minutes of reports of the incident emerging.
“Millions of people trust notifications from apps on their phones because they are supposed to come directly from the company,” said Charlotte Wilson, head of enterprise for the UK & Ireland at AI security company Check Point. “The fact that an attacker may have been able to hijack that relationship and send a threat directly to customers demonstrates how quickly a cyber incident can move from the server room to the front page, and then straight into the market value of a business.”
However, she added that it was important not to speculate on exactly what has been accessed until ASOS has established the facts.
The BBC has been hearing from ASOS customer about the breach, with many sharing concerns about personal information such as their addresses and bank details being compromised. One described the silence from ASOS so far as “poor on all fronts.”
The reality of the threat remains unclear, but the damage from uncertainty is already visible. With customers afraid to log into their ASOS accounts or share data with the retailer, the challenge now for ASOS is not only containing any technical breach but also protecting the trust that underpins every digital retail transaction.
Stay informed
Our editor carefully curates two newsletters a week filled with up-to-date news, analysis and research. Click here to subscribe to the FREE newsletter sent straight to your inbox. Why not follow us on LinkedIn to receive the latest updates on our research and analysis?
