Asos应用遭黑客推送勒索通知 股价重挫近10%并启动调查Asos Shares Plunge as App Users Receive Push Notifications Threatening Data Leak

数十名英国消费者在社交媒体上反馈，其手机安装的Asos移动应用突然弹出标题为“Asos hacked”的异常通知。这条直接呈现在用户手机屏幕上的通知并未面向普通顾客，而是指名写给零售商内部人员，内容写道：“尊敬的Asos DPO及IT部门，我们已完全攻破Snowflake实例。请与我们接洽，否则我们将泄露数据。”

Dozens of Asos customers across the United Kingdom reported receiving an unusual alert titled "Asos hacked" popping up on their phone screens through the retailer's official mobile application. Although sent directly to consumer devices, the text was explicitly targeted at the company's internal staff, stating: "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it."

该推送通知附带了一个外部链接，将点击用户直接导向即时通讯应用Telegram上的特定频道。这一频道的运营方自称为“Xuanye Group”，且该频道在10月6日当天刚刚创建，截至事件发生时仅发布过三条信息，其中最新的一条正是关于此次针对Asos的攻击。面对媒体的置评请求，Asos并未立即作出回应。

The notification embedded a direct link that steered recipients to a specific channel on the Telegram messaging service operated by a previously unknown entity calling itself the Xuanye Group. Records indicated the Telegram channel was created on October 6 and contained only three posts, with the latest entry referencing the Asos incident. Asos did not immediately respond to requests for comment regarding the push alerts.

受数千名用户收到黑客勒索弹窗消息影响，富时250指数成分股Asos在伦敦证券交易所的股价迅速重挫，跌幅一度超过10%。投资者对潜在的数据泄露规模以及后续可能的财务和法律风险表现出担忧，导致这家英国线上快时尚巨头的市值在早盘交易中显著缩水。

Following reports that thousands of mobile users received extortion notifications on their devices, shares of FTSE 250 constituent Asos tumbled by more than 10% on the London Stock Exchange. The sharp sell-off reflected immediate market concern over the potential scale of the claimed breach and the financial implications for the British online fashion giant as trading opened under heavy downward pressure.

在资本市场剧烈波动的同时，Asos的官方零售网站和移动应用程序在周二上午依然维持正常在线运营，未出现服务中断。据了解，Asos内部技术团队正在针对是否确实发生了黑客攻击展开全面调查，以核实攻击者是否真正获取了Snowflake云数据平台中的敏感资料。

Despite the acute financial reaction, Asos's consumer-facing website and mobile application continued operating online on Tuesday morning without facing widespread service outages. The retailer is actively investigating the incident to determine whether any unauthorized system intrusion actually took place and to verify whether the attackers succeeded in compromising sensitive corporate records stored on its cloud infrastructure.

网络安全界此前对自称“Xuanye Group”的组织并无了解。安全研究人员指出，该团伙此前从未在黑客论坛或其他Telegram频道被提及过，此次高调推送通知可能是为了引起广泛关注。网络安全机构Sophos的首席威胁研究员艾登·辛诺特分析称，新黑客团伙在寻找自认为重大的机会前保持潜伏并不罕见，他们往往借此类标志性行动公开亮相，以此在网络犯罪圈建立所谓的信誉。

Cybersecurity experts had not encountered the self-proclaimed Xuanye Group before Tuesday's incident. Security researchers noted that the entity had no prior record or mention on underground hacker forums or other Telegram channels, suggesting the dramatic push alert may have been an effort to seize widespread public attention. Aiden Sinnot, principal threat researcher at cybersecurity firm Sophos, explained that it is common for emerging cyber groups to wait for what they perceive as a major opportunity before announcing themselves, using such high-profile incidents to establish perceived credibility within the criminal ecosystem.

针对技术入侵路径，网络安全专家指出事件暴露了多层系统的风险。安全公司Horizon3的丹·伯德表示，向Asos应用用户发送推送通知需要获取该公司的通知系统权限，而该系统独立于攻击者声称攻破的Snowflake数据平台；若两项指控属实，表明黑客掌握了可打开多个系统大门的访问凭证。安全公司Huntress的高级运营经理德雷·阿加也指出，Snowflake作为云数据库通常存储着敏感客户资料，推送通知的发出意味着攻击者侵入了控制移动应用的内部管理系统。

Analyzing the technical attack vectors, specialists emphasized that the incident points to potential access across multiple distinct environments. Dan Bird from cybersecurity firm Horizon3 noted that sending push notifications to app users required direct access to Asos's internal notification system, which functions separately from the Snowflake data platform the group claimed to compromise. Bird stated that if both claims hold up, attackers likely obtained credentials unlocking more than one door. Dray Agha, senior manager of security operations at Huntress, also observed that push alerts indicate attackers breached systems controlling the mobile app alongside any potential database compromise.

针对Asos应用推送事件，在线服务提供商NordVPN首席技术官马里尤斯·布里埃迪斯提醒，消费者当前需要对后续动向保持高度警惕。此类备受瞩目的网络事件往往为钓鱼攻击创造条件，不法分子可能会利用事件知名度冒充Asos发送电子邮件或手机短信，诱导消费者重置密码、确认支付信息、核对订单或申请退款。

Following the push alert incident affecting Asos application users, online service provider NordVPN chief technology officer Marijus Briedis warned that consumers should remain vigilant regarding what happens next. High-profile cyber incidents create favorable conditions for follow-on phishing attacks, as cybercriminals may exploit the publicity by distributing deceptive emails and text messages impersonating Asos. These communications often trick recipients into resetting account passwords, confirming payment details, checking retail orders, or claiming refunds.

该起疑似黑客事件发生前，英国多家主要零售商已遭遇过网络安全事件。玛莎百货、Co-op以及哈罗德百货去年均受到网络攻击冲击，其中玛莎百货与Co-op遭遇商品库存短缺，玛莎百货更被迫关闭官方网站数周以清理和修复内部系统。

The potential breach follows a series of cyber security disruptions that hit British retailers over the past year. Marks & Spencer, the Co-op, and luxury department store Harrods all suffered cyber incidents, with Marks & Spencer and the Co-op experiencing stock shortages, and Marks & Spencer being forced to take down its retail website for several weeks while working to clean its compromised internal systems.