ASOS Suffers Suspected Data Breach, Prompting Security Concerns and Stock Plunge

The popular online fashion retailer ASOS is under suspicion of a data breach, following reports on Tuesday, October 6, from numerous users in Israel and abroad. These users received a notification via the ASOS mobile app, alerting them to a hack and urging security personnel to respond via an embedded link, with threats of stolen data being leaked online. It is suspected that hackers infiltrated ASOS's computer systems to send these notifications.

While the ASOS website and app are reportedly functioning normally, customers are advised to monitor for any unusual activity during product selection and checkout. ASOS, a British company with a significant presence in the Israeli market, even offers special discounts to Israeli customers. Following the notification incident, an internal investigation has been launched, according to The Guardian. The London Stock Exchange reacted to the suspicion with a sharp decline in ASOS's share price, with its stock losing over 14% in a single trading day.

If the breach is confirmed, an investigation will likely focus on how hackers gained access to Snowflake, a platform used by ASOS for data storage and processing, and subsequently controlled the messaging system. The extent of the data stolen remains unknown, but customer information is considered to be at high risk. Dror Aga, a senior manager at cybersecurity firm Huntress, told The Guardian that if the breach claims are true, "there is a serious cause for concern. Snowflake and similar platforms are used to store important information."

The suspicious link in the notification directs users to a Telegram channel belonging to a previously unknown group calling itself Xuanye. Experts suggest the entire hacking incident might be a ploy to draw attention to this group. Israeli cybersecurity specialist Osher Cohen, founder of YO Secure, warned Ynet that the primary concern for users should be the potential for fraud attempts following the publicity of the alleged breach. He noted that customers often receive alerts about compromised accounts, demanding personal or credit card details, and that even experienced users can fall victim.

Cohen advises users "not to click on any links in messages sent on behalf of ASOS" and to verify any concerns by visiting the official website or app directly. He also recommends changing passwords if the same ones are used on multiple sites. Cohen emphasized that the damage from such attacks extends beyond stolen data, impacting customer trust in the company's ability to protect personal and payment information, potentially leading to significant financial and reputational losses for ASOS.