If a strange-looking message from Asos popped up on your phone today, you may be worrying what it could mean and whether you need to do anything. The online retailer has emailed customers apologising for the "unauthorised push notification" containing an external link, adding that they should disregard the message and not click on it. Here's what has happened, and what those who may have been affected are being advised to do.
On Tuesday morning, Asos users across the UK were sent pop-up messages from its app that appear to have been sent by hackers trying to extort the company. "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it," the message read.
Later that day, Asos said it took immediate action to restrict the apparent hackers' access, was investigating and working with advisers and relevant authorities on "next steps". Data storage company Snowflake told the BBC its investigations had "found no compromise" of its platform. At this stage it isn't clear what information, if any, has been accessed.
On Tuesday evening, Asos told customers it may include "basic personal information including name and contact details". "However, we don't believe that any payment-card information or account passwords have been impacted," it added. While those who received the pop-up message will undoubtedly be concerned, it does not mean your phone has been hacked.
Don't click the link: The hack notification included a link to a Telegram account - Asos and cyber security experts say not to click on it Change passwords: It's worth updating your password, including across other sites that use the same one as your Asos account. The advice for a strong password is to mix numbers, symbols and upper and lower case characters, and avoid using the same password across multiple accounts Turn on two-step verification for important apps like banking and email: The National Cyber Security Centre (NCSC) calls this "one of the most effective ways to protect your online accounts from cyber criminals". You can usually turn it on by going into the security settings in your account Monitor transactions: Keep an eye on your online transactions for anything unusual According to Charlotte Wilson, head of enterprise at global cyber-security firm Check Point, "the biggest immediate risk may be what happens next".
She says criminals know people will be searching for information online and expects there to be "attempts to exploit that confusion". Her advice to Asos customers is not to be "scared and frightened". But she says they should be "extremely suspicious" of emails, texts or messages claiming their account has been compromised, offering a refund or asking them to click a link to reset their password.
Extract — continue reading at the source.
