ASOS says a breach began with an attacker impersonating a trusted contact
ASOS's advice on what it will and won't ever ask you for is worth knowing before the phishing starts.
UK online retailer ASOS says an attacker impersonated a trusted contact to get an employee's login credentials, then used them to reach data on third-party platforms ASOS uses. Customers' full names, contact details and some account information were exposed; ASOS says card details and passwords were not. A group calling itself "Xuanye Group" claimed the theft after pushing notifications to ASOS app users on October 6. ASOS has not said how many customers are affected.
-
Social engineering (security)
After exploring ASOS links data breach to social engineering attack, credential theft, the technique used is Social engineering (security).
Using psychological pressure to get people to take actions or reveal confidential information. Phishing is one type, and it is often just one step in a larger fraud.
Wikipedia · Wade · 5 min
0