Denmark CPR Data Breach: 8.8 Million People Exposed Through a Private Company's Account
Attackers spent 10 days pulling names, addresses and CPR numbers via a partner firm's legitimate access. What it teaches about third-party access risk.
Incidents
ASOS Hacked: Attackers Send "ASOS HACKED" Push Notification to Customers Through the Official App
Attackers hijacked a third-party ASOS messaging platform and pushed a threat to app users. Names and contact details may be exposed. What's the lesson?
On Tuesday morning, users of the app from ASOS, one of Europe’s largest online fashion retailers, received a notification that no marketing team would ever have approved. The headline read “ASOS HACKED,” and the message was addressed directly to the company’s data protection officer and IT department. The attackers claimed they had fully compromised the company’s data environment in Snowflake and threatened to publish the data unless ASOS agreed to negotiate. The message included a link to a Telegram channel.
What the company has confirmed
ASOS acknowledged that unauthorized access was gained to third-party platforms it uses to communicate with customers, and said it shut off that access immediately. According to the company, basic personal information, such as names and contact details, may have been exposed. ASOS believes that payment card data and account passwords were not compromised. The company has not said how many customers are affected.
A previously unknown group calling itself “Xuanye group” has claimed responsibility. Its claims about compromising the Snowflake environment have not been verified. Note that sending the notification required access to the push notification system, which is a separate tool from the data warehouse.
Why this matters
The attackers went further than a post on a leak site. They showed they could message millions of customers through the company’s official channel. The same access could be used for something far more dangerous: for example, a “refund” message sent from the real app with a link to a fake payment page.
What to check in your own organization
- Inventory your communication tools. Push notification systems, email and SMS delivery services, marketing platforms: who has access to them, and are those accounts protected with two-factor authentication?
- API keys and tokens. Access to third-party platforms often relies on keys with no expiration date, stored in code or in CI tools. Rotate them and restrict their permissions.
- A “four-eyes” rule for mass messages to customers, plus an alert whenever a message goes out outside the planned schedule.
- A ready-made crisis statement. Customers saw “ASOS HACKED” before they saw the company’s official response. Have a template and a decision-making path prepared in advance.
ASOS customers should be especially cautious about any messages “from ASOS” in the coming weeks. Don’t click links asking you to pay an extra charge, verify your account or claim a refund. Open the app yourself instead.
Sources: BleepingComputer, Malwarebytes, Computer Weekly
