Asos says 'unauthorised activity' and names 'may have been accessed'; the message its customers got said 'we will leak it'
On Tuesday Asos's own app sent its customers an alert saying the retailer had been hacked. Four reports from the UK, Ireland and Australia describe the same alert in very different terms. Only one carries Asos's statement that payment cards and passwords were not affected. Nobody has said how many customers' data was taken.
What happened. On Tuesday morning, customers using the Asos app received a notification titled "Asos hacked", The Independent reports. Asos later confirmed that an "unauthorised customer notification" had gone out through its app.
Four reports, two framings. The two Irish reports and the Australian one came out first. They lead on the alert. The Independent, last of the four, leads on the company's words.
| Outlet | Leads with | Says payment cards and passwords were safe? |
|---|---|---|
| RTÉ News | Asos's "unauthorised activity" | No |
| TheJournal.ie | "bizarre, threatening message"; "the company is hacked" | No |
| ABC News (Australia) | "Engage with us, or we will leak it" | No |
| The Independent | Asos's "unauthorised activity" | Yes, as Asos's belief |
Where they agree. All four carry Asos's statement that names and contact details "may have been accessed".
The Snowflake claim. The message says the attackers "full compromised the Snowflake instance". The Independent reports that Snowflake, the cloud firm named, says it has "found no compromise" of its platform.
The cost. The Independent reports that Asos shares fell by more than 10% on Tuesday.
What is NOT settled - How many customers' data, if any, was taken. No report gives a number. - Whether payment cards and passwords are safe. Only Asos says so, and it says it only "believe[s]" it. - Who sent the message, and whether the attackers hold what they claim. - Whether Asos has engaged with the attackers. No report says.
What this is about. Someone took over the system Asos uses to send alerts to customers' phones. They used it to tell those customers the company had been hacked, and to threaten to leak data.
How it got here. Asos is a British online fashion retailer listed on the London Stock Exchange. It sells mainly to young shoppers in many countries. The Independent reports that it has 16.5 million customers and that the UK brings in 49% of its revenue. It also reports that Asos is partway through a turnaround programme meant to stop falling sales and get back to profit.
The attack comes after a run of attacks on British retailers. The Independent names Marks & Spencer and Harrods among those hit over the past two years.
The message names Snowflake, a US company that stores data in the cloud for many large businesses. When a business's account with a cloud provider is broken into, the business and the provider often disagree about where the weakness was. The Independent reports that Snowflake says it has found no compromise of its own platform.
Who is involved. Asos is the company holding the data. Its customers in the UK, Ireland and Australia got the alert. The attackers are unnamed and gave only a Telegram link. The Independent reports that the National Cyber Security Centre, which is part of GCHQ, has offered Asos help. Under data protection law in the UK and the EU, a company has to report a breach of personal data to its regulator. In the UK that regulator is the Information Commissioner's Office. In Ireland it is the Data Protection Commission.
What is at stake. If the attackers have the data, customers' names and contact details could be published or used to send convincing scam messages. A security expert quoted by The Independent warns of this kind of phishing. If they do not have it, the incident is a hijacked alert system and a fall in the share price.
Where it stands. Asos says its investigation is ongoing and that its website and app are working normally.
What is being argued about
- Whether the alert means customer data was stolen, or only that the alert system was hijacked
- Asos's belief that payment cards and passwords were not affected, which only one report carries
- The attackers' claim about Snowflake against Snowflake's statement that it found no compromise
- How many customers were affected, which no report says
Claims and verdicts
The Independent
The Independent
🇬🇧UK ·
digital · independent
Asos says customer data may have been accessed after ‘unauthorised activity’
Open this report in The AI Times →
Read it at The Independent →
What we have measured
Accused party response Russia's side is reported as no comment. ×1A company statement about itself, taken as a "reveals" rather than "says", for a company's account of its own product ×1A count stated flat four crimes is given as a settled number in the headline, with no court, charge or jurisdiction attached ×1Actor named No actor named for the cut-short or for the clashes ×1
Outlet profile in The AI Times →
ABC News (Australia)
ABC News (Australia)
🇦🇺AU ·
public broadcaster · public-service
Irish customers of Asos receive bizarre, threatening message as the company is hacked
Open this report in The AI Times →
Read it at TheJournal.ie →
What we have measured
Accuracy of attribution The report calls the Tánaiste the Taoiseach partway through. That puts his words under another office. ×1Accusation carried without a reply a charge against a named party, no answer from it in the text held ×1Actor labelling calls the accusers 'opposition parties' when the named accuser is the deputy First Minister ×1Actor mislabelled The first line calls the accusers 'opposition parties', but the accuser quoted is the DUP deputy First Minister, who sits in the same executive ×1
Outlet profile in The AI Times →
The Independent
The Independent
🇬🇧UK ·
digital · independent
Asos says customer data may have been accessed after ‘unauthorised activity’
Open this report in The AI Times →
Read it at The Independent →
What we have measured
Accused party response Russia's side is reported as no comment. ×1A company statement about itself, taken as a "reveals" rather than "says", for a company's account of its own product ×1A count stated flat four crimes is given as a settled number in the headline, with no court, charge or jurisdiction attached ×1Actor named No actor named for the cut-short or for the clashes ×1
Outlet profile in The AI Times →
Asos customers told online retailer hacked in phone alert
Open this report in The AI Times →
Read it at RTÉ News →
What we have measured
Abstraction as the actor the dispute acts and no one in it is named ×1Account taken as default the police description of the crowd as 'hostile' is carried with no other account ×1Accuracy the Slovenia entry in the country list repeats Austria's name ×1Active voice offender Donaldson is named as the one who did the abuse, in the active voice. ×1
Outlet profile in The AI Times →
The Independent
The Independent
🇬🇧UK ·
digital · independent
Asos says customer data may have been accessed after ‘unauthorised activity’
Open this report in The AI Times →
Read it at The Independent →
What we have measured
Accused party response Russia's side is reported as no comment. ×1A company statement about itself, taken as a "reveals" rather than "says", for a company's account of its own product ×1A count stated flat four crimes is given as a settled number in the headline, with no court, charge or jurisdiction attached ×1Actor named No actor named for the cut-short or for the clashes ×1
Outlet profile in The AI Times →
ABC News (Australia)
ABC News (Australia)
🇦🇺AU ·
public broadcaster · public-service
Who wrote it
The Independent
ABC News (Australia)
Coverage, outlet by outlet
The Independent
The Independent
🇬🇧UK ·
digital · independent
Asos says customer data may have been accessed after ‘unauthorised activity’
Open this report in The AI Times →
Read it at The Independent →
What we have measured
Accused party response Russia's side is reported as no comment. ×1A company statement about itself, taken as a "reveals" rather than "says", for a company's account of its own product ×1A count stated flat four crimes is given as a settled number in the headline, with no court, charge or jurisdiction attached ×1Actor named No actor named for the cut-short or for the clashes ×1
Outlet profile in The AI Times →
— independent
ABC News (Australia)
ABC News (Australia)
🇦🇺AU ·
public broadcaster · public-service
Irish customers of Asos receive bizarre, threatening message as the company is hacked
Open this report in The AI Times →
Read it at TheJournal.ie →
What we have measured
Accuracy of attribution The report calls the Tánaiste the Taoiseach partway through. That puts his words under another office. ×1Accusation carried without a reply a charge against a named party, no answer from it in the text held ×1Actor labelling calls the accusers 'opposition parties' when the named accuser is the deputy First Minister ×1Actor mislabelled The first line calls the accusers 'opposition parties', but the accuser quoted is the DUP deputy First Minister, who sits in the same executive ×1
Outlet profile in The AI Times →
—
Asos customers told online retailer hacked in phone alert
Open this report in The AI Times →
Read it at RTÉ News →
What we have measured
Abstraction as the actor the dispute acts and no one in it is named ×1Account taken as default the police description of the crowd as 'hostile' is carried with no other account ×1Accuracy the Slovenia entry in the country list repeats Austria's name ×1Active voice offender Donaldson is named as the one who did the abuse, in the active voice. ×1
Outlet profile in The AI Times →
— PUBLIC
The Guardian
The Guardian
🇬🇧UK ·
newspaper · independent
What we have measured
Actor named Denial in the passive voice, with no one named as the person who dismissed it ×1Actor named names Israel as acting and states the death toll flat, with no source ×1Actor named Ireland named as the side that ended the conference ×1Allegation omitted the police statement is cut with an ellipsis where the other two reports carry the controlling or coercive behaviour allegation ×1
Outlet profile in The AI Times →
C
CBC News
BBC News
BBC News
🇬🇧UK ·
public broadcaster · public-service
What we have measured
Dating and attribution 'It was not until Tuesday' is a judgement about delay, not a date. No other report we hold comments on how long the German finding took. ×1How hard the claim is stated Headline says the UN voted to adopt and replace; the last sentence of the report says the vote is non-binding ×1How hard the claim is stated The qualification arrives in the last sentence and is immediately overridden by an effect the report gives no source for. ×1Which figure is used States the replacement as done — the Assembly voted to replace the map — where the resolution urges states to use a different projection. ×1
Outlet profile in The AI Times →
The Daily Telegraph
The Daily Telegraph
🇬🇧UK ·
newspaper · independent
What we have measured
Outlet profile in The AI Times →
The Times
The Times
🇬🇧UK ·
newspaper · independent
What we have measured
Outlet profile in The AI Times →