ASOS says stolen employee credentials led to customer data breach

Attackers impersonated a trusted contact to obtain an employee’s work account login, Bloomberg reports. They compromised a third-party customer communication platform and sent unauthorized notifications to users. The investigation found that exposed information included names, contact details and some non-personal account information, according to The Record.

• ASOS is updating affected customers, according to BleepingComputer.
• External experts assisted the investigation, according to The Record.

Covered by 5 publishers within 31 hours of the first report.

• BleepingComputer: ASOS links data breach to social engineering attack, credential theft
• Latest 12:57 PM ET The Record: ASOS: Hackers tricked way into employee account before sending rogue push notification

Reporting5

SW SecurityWeek ASOS Confirms Cyberattack, Data Breach · Ionut Arghire 5:46 AM

BL Bloomberg Hackers Tricked Asos Employee to Steal Work Account Login · Deirdre Hipwell and Ryan Gallagher 6:11 AM

BC BleepingComputer ASOS links data breach to social engineering attack, credential theft · Bill Toulas 7:42 AM

QZ Quartz Asos says hackers tricked an employee into handing over their work account login · Cris Tolomia 8:20 AM

REC The Record ASOS: Hackers tricked way into employee account before sending rogue push notification 12:57 PM

Related

AA Hackers leak data on all 3,615 Trump Mobile subscribers via partner breach October 7

CSN EY breach exposes data linked to Goldman Sachs and Man Group October 6

BC Nikkei says attackers breached employee email accounts October 5

THN Attackers breach three domain registries to get Google HTTPS certificates October 7

Topics Data breaches