ASOS links data breach to social engineering attack, credential theft
-
ASOS has begun notifying customers about a cybersecurity incident that occurred earlier this week, confirming that attackers accessed some personal data. According to the company, the breach stemmed from a social engineering attack combined with credential theft, rather than a direct technical exploitation of its systems.
The retailer has not disclosed the exact number of affected customers or the specific categories of personal data involved. It is contacting impacted individuals directly with guidance.
Key points:
- Attack vector: social engineering leading to credential compromise
- Data accessed: some customer personal data, per ASOS
- Notification: updates being sent to affected customers
- No specific CVE or advisory identifier was provided in the source material
ASOS customers should watch for phishing attempts referencing the incident, as stolen personal data can be reused in follow-on social engineering campaigns. Anyone who receives an ASOS notification should verify the sender and avoid clicking unsolicited links.
Source: BleepingComputer
Have you or your organization reviewed your credential-handling and anti-social-engineering controls in light of incidents like this?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login