If a strange-looking message from Asos popped up on your phone on Tuesday, you may be worrying what it could mean and whether you need to do anything. The online retailer has emailed customers apologising for the “unauthorised push notification” containing an external link, adding that they should disregard the message and not click on it. Here’s what has happened, and what those who may have been affected are being advised to do. On Tuesday morning, Asos users across the UK were sent pop-up messages from its app that appear to have been sent by hackers trying to extort the company.
“Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it,” the message read. Later that day, Asos said it took immediate action to restrict the apparent hackers’ access, was investigating and working with advisers and relevant authorities on “next steps”. Data storage company Snowflake told the BBC its investigations had “found no compromise” of its platform.
At this stage it isn’t clear what information, if any, has been accessed. On Tuesday evening, Asos told customers it may include “basic personal information including name and contact details”. “However, we don’t believe that any payment-card information or account passwords have been impacted,” it added. While those who received the pop-up message will undoubtedly be concerned, it does not mean your phone has been hacked.
For now, the advice is: Don’t click the link: The hack notification included a link to a Telegram account – Asos and cyber security experts say not to click on it Change passwords: It’s worth updating your password, including across other sites that use the same one as your Asos account. The advice for a strong password is to mix numbers, symbols and upper and lower case characters, and avoid using the same password across multiple accounts Turn on two-step verification for important apps like banking and email: The National Cyber Security Centre (NCSC) calls this “one of the most effective ways to protect your online accounts from cyber criminals”. You can usually turn it on by going into the security settings in your account Monitor transactions: Keep an eye on your online transactions for anything unusual According to Charlotte Wilson, head of enterprise at global cyber-security firm Check Point, “the biggest immediate risk may be what happens next”. She says criminals know people will be searching for information online and expects there to be “attempts to exploit that confusion”.
Her advice to Asos customers is not to be “scared and frightened”. But she says they should be “extremely suspicious” of emails, texts or messages claiming their account has been compromised, offering a refund or asking them to click a link to reset their password. People should hang up the phone if they receive any calls from someone they think might be posing as Asos or another organisation, says Which? spokesperson Kat Cereda. The consumer rights expert says they should contact the organisation themselves afterwards through separate means.
It’s been less than 24 hours since the notification popped up on people’s phones, and there are a number of unanswered questions. It isn’t yet clear who is behind the message, what their motivation is, how many people received the notification or how many may be impacted Wilson, from the cyber-security firm Check Point, says there’s still “an awful lot” we don’t know. Asos said its website and app were operating “as normal, and customers can continue to shop with confidence on ASOS as normal” as of Tuesday night. It said protecting customers “is our priority”, and it will provide a further update “as soon as we have confirmed more information”.
People should visit Asos’s official website directly for updates. ASOS app users receive push notifications apparently sent by hackers
