Hackers who infiltrated fashion firm Asos's website are feared to have detailed profiles from millions of customers.
asserted
who → infiltrate → customers
The company has given an update after the hack earlier this week amid revelations the breach went beyond what was previously thought to be 'basic contact details'.
asserted
what → give → revelations
Cyber-criminals behind the attack could now have access to shoppers' names, addresses, phone numbers, email addresses and past searches on the site.
uncertain
criminals → have → site
In a new email to consumers, Asos said: 'Please remain cautious of unexpected messages or calls claiming to be from Asos.
asserted
Asos → say → Asos
'We will never ask you to share passwords, security codes or payment details through an unsolicited message or call.'
asserted
We → ask → message
BBC News today told of being contacted by hackers who claimed they had access to extra information about Asos customers.
asserted
they → tell → customers
Asos confirmed on Tuesday hackers could have accessed 'basic personal information' after customers received an 'unusually brazen' message threatening to leak their data.
uncertain
customers → confirm → data
In a statement issued after the 'unauthorised' notification was sent, the firm said that it did not believe 'payment card details or passwords were impacted'.
asserted
details → issue → statement
Millions of customers are feared to be affected by a cyber-hack of the fashion firm Asos
Messages sent by the hackers to customers' phones said they had 'fully compromised the Snow flake instance', referring to the online platform that collects data, including that of customers.
asserted
that → fear → customers
The notification included a threatening message to Asos: 'Engage with us or we will leak it'.
asserted
we → include → it
It also contained a link to the hackers' Telegram channel, the 'Xuanye Group', that was only created the previous day.
It is understood messages later appeared on that channel claiming that 'customer information is safe on our server' and 'it will not be touched for a designated period'.
asserted
it → contain → period
One message from the hackers is said to read: 'Considering the current situation regarding incident disclosure in the cyber security landscape, you can thank us for our generous clarity regarding this incident.'
asserted
you → say → incident
The hackers had demanded a ransom payment from Asos in exchange for deleting customer information.
asserted
hackers → demand → information
It quoted a text from messaging app Telegram, saying: 'Our message is clear, and simple to recognise.
asserted
message → quote → Telegram
The organisation must contact us or we will leak it [customers' data], that is what we said.
asserted
we → contact → what
The 2-week period is intended for them to make contact, they know what happened.'
asserted
what → intend → contact
The hackers said in an online notification: 'Dear ASOS DPO and IT, we have fully compromised the Snowflake instance.
asserted
we → say → instance
Engage with us, or we will leak it.
asserted
we → engage → it
Snowflake is a cloud-based platform that firms use to store, process and analyse data and an 'instance' refers to a customer's individual environment on the platform.
asserted
instance → base → platform
Shares in Asos, which also owns brands including Topshop and Miss Selfridge, fell by more than nine per cent after reports of the hacking emerged.
asserted
reports → own → hacking
Cyber-security experts said the hackers' 'unusually brazen' notification was 'designed to whip up panic'.
asserted
notification → say → panic
A statement was released by Asos on Tuesday in which the firm apologised to customers if they had received the 'unauthorised push notification'.
asserted
they → release → notification
In a further statement to the London Stock Exchange, it said: 'Asos can confirm that, at around 10am today, an unauthorised customer notification was sent to Asos customers.'
asserted
notification → say → customers
'We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers.
asserted
we → investigate → customers
'We took immediate action to restrict access to the notification platforms and are working with our internal and external specialist advisers, as well as all relevant authorities.
asserted
We → take → advisers
'Basic personal information including name and contact details may have been accessed.
uncertain
information → include → name
We do not believe that payment-card information or account passwords were impacted.
asserted
information → believe → ?
'Our website and app are operating as normal, with no current disruption to any aspects of our operations.
asserted
website → operate → operations
'Customer trust is incredibly important to us, and if the situation changes an update will be provided as appropriate.
asserted
update → change → us
'The Company has cyber security insurance with a large global provider, including business continuity insurance.
asserted
Company → have → insurance
It is too early to quantify any potential impact on trading.'
asserted
It → quantify → trading
Katherine James, director of Snowflake's Europe, Middle East and Africa communications team, told the BBC: 'As soon as we became aware of the notification that is currently being reported, we began an investigation.
asserted
we → tell → investigation
At this time, we can report that we have found no compromise of the Snowflake platform.
asserted
we → report → platform
We take customer privacy and security very seriously.
asserted
We → take → privacy
The investigation is ongoing and we will provide further updates as soon as more information becomes available.'
asserted
information → provide → updates
Asos says it has 17 million customers in 150 countries.
asserted
it → say → countries
Panicked customers reacted online to the 'crazy notification' and some said they had 'never deleted my payment methods so quick'.
asserted
they → react → methods
Marie Wilcox, VP of market strategy at cyber-security firm Binalyze, said: 'This notification was psychological warfare, designed to whip up panic.
asserted
notification → say → panic
Attackers know that any panic piles on the pressure on Asos to think about paying up rather than taking time to develop a rational response.
asserted
panic → know → response
Asos is legally obliged to tell customers if their data has been breached under the UK's data protection law.
asserted
data → oblige → law
…and 10 more, not listed.
The Aporia
