Online fashion retailer ASOS has confirmed a breach of customer data, and Australian shoppers are among those who may be affected. Customers first heard about it the hard way: a push notification from the ASOS app, sent by the attackers, claiming they had “fully compromised” the company’s cloud storage. Australian customers reported receiving it at about 8pm AEST.
How it happened
According to ASOS, the attackers did not break in through some exotic technical flaw. They tricked an employee into handing over their work account login. The group, reported as the Xuanye Group, then used those credentials to get into the third-party platforms ASOS uses to communicate with its customers.
The picture has also grown since the first announcement. The BBC reports the attackers took more personal details than ASOS first revealed, going beyond “basic contact details”, and ASOS has issued an update. Computer Weekly reports the criminals appear to have a much more complete picture of the customer base than first thought.
Why this matters for a small business
Most businesses now rely on outside services to talk to customers – email marketing, SMS, booking systems, online stores. Each one is usually reached with a staff login. If that login can be talked out of someone, the attacker gets whatever that person can see and send.
Three things worth checking this week:
- Turn on multi-factor authentication for every platform that holds customer data or can message customers, not just email.
- Review who has access. Remove former staff and anyone who does not need it, and avoid shared logins.
- Agree a simple rule with your team: nobody gives a password or code to anyone who asks for it, however urgent or official the request sounds. Verify by calling a known number.
If you shop with ASOS, be extra cautious of emails, texts or calls that mention your account or order, as stolen details are often reused in follow-up scams.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.
Sources
- Asos confirms breach of customer data after hackers send rogue app notification – TechCrunch
- Asos says hackers tricked an employee into handing over their work account login – Quartz
- Asos hackers took more personal details than first revealed, BBC finds – BBC News
- Scope of Asos data breach wider than first reported – Computer Weekly
- Thousands of Aussies potentially caught up in data breach at ASOS – Daily Mail Australia