Online fashion retailer ASOS has confirmed a data breach following an incident in which unauthorized push notifications reading "HACKED" were sent directly to customer devices through its mobile application, according to reporting by Accredited Wire Reports.
The alert messages, which appeared unexpectedly on users' screens, prompted widespread concern among shoppers regarding the security of their personal information and account integrity. The incident originally came to light following coverage by cybersecurity news outlet BleepingComputer, which noted the sudden appearance of the rogue in-app messages.
Security Breach Acknowledged
Following the unauthorized alerts, the company acknowledged that an unauthorized intrusion had compromised aspects of its systems. The incident allowed the threat actors to leverage the platform's communication infrastructure to dispatch the mass notification to users.
While the appearance of the notifications caused immediate alarm across the customer base, technical teams began investigating the perimeter of the breach to determine how deep the intrusion reached within the retailer's software ecosystem. Accredited Wire Reports indicated that the company responded to verify the occurrence of the security event once the unauthorized messages were confirmed.
Investigation into System Access
Questions remain regarding the full extent of the compromise, including whether customer financial details, passwords, or personal identifying information were accessed alongside the push notification messaging system. ASOS has worked to evaluate the unauthorized entry point to contain the vector used by the attackers.
Mobile push notification systems often rely on third-party integration platforms, which can become targets for malicious actors seeking to broadcast disruptive messages. The retailer's disclosure marks the beginning of an ongoing assessment into the incident as cybersecurity specialists analyze system access logs to safeguard affected infrastructure.
