Asos Investigating Potential Hack

Asos customers receive ‘hack’ notification threatening leak

Asos is investigating after users of its mobile app received a notification claiming hackers had “fully compromised” the online fashion retailer’s data.

The value of Asos’s shares on the London Stock Exchange dived almost 10% after thousands of customers received a notification titled “Asos hacked” with a link that sent them to the Telegram messaging service.

The website and app appeared to be continuing to operate on Tuesday morning and it is understood that Asos is still investigating whether any hack has taken place.

The message sent out to customers said: “Dear Asos DPO [data protection officer] and IT, we have fully compromised the Snowflake instance.”

Snowflake is a cloud platform used to store, process and analyse data including transactions and demographic information such as clothing sizes and body measurements. It also enables push notifications to clients’ phones.

Georgia Power customer data may have been accessed in data breach, company says

Georgia Power is investigating an unauthorized data breach that may have accessed some of its customers' information.

In an email sent to some Georgia Power customers, the company said that it detected unauthorized activity by a third party on some accounts recently.

The company said that the unauthorized party had access to some information connected to accounts, including names, addresses, phone numbers, emails, and the last four digits of social security numbers. The breach did not allow the third party to see information such as bank account, payment card or driver's license numbers, Georgia Power said.

"Upon detection, we took immediate steps to stop the activity. We have engaged law enforcement and are conducting a thorough investigation," the email read in part.

Georgia Power does not believe the unauthorized access to accounts is still going. The identity of the third party behind the data breach has not been released.

EXCLUSIVE: Accenture contractor removed from FBI following damaging data breach, sources say

The Federal Bureau of Investigation removed an Accenture contractor on Monday over their role in a damaging data breach that exposed sensitive personal details of thousands of bureau employees, two sources familiar with the matter told Reuters.

The development comes as the FBI is still trying to ascertain the ramifications of the breach, which some former bureau officials have described as a major blow to the organization's operational security.

In a statement to Reuters, a senior FBI official confirmed that an unidentified contractor had failed to properly update — or patch — ⁠the system they were responsible for.

"To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform," FBI cyber chief Brett Leatherman said in the statement. "As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce."

Police Urge Passkey Use After Surge in Cybercrime Profits

The UK’s Report Fraud service has launched a new public awareness campaign urging internet users to switch to passkeys, after revealing a major increase in sums stolen from victims.

The fraud reporting service said that cybercrime linked to email and social media hacking netted scammers £6.3m ($8.3m) in 2025/6, up from £1.2m ($1.6m) the year previously.

The number of reports for this type of account takeover increased by a third (34%) over the same period.

Report Fraud didn’t go into much detail about the tactics cybercriminals use to monetize their access to victims’ accounts, aside from claiming that one of the most common is impersonating family and friends.

Impersonation can come in various forms, but one of the most popular techniques to trick victims into sending funds is to impersonate the account owner and pretend to be in trouble.

Ransomware Affiliate Double-Crosses Operator to Steal Victim Funds

A Russian-speaking cybercriminal betrayed his ransomware-as-a-service (RaaS) partners to make off with funds extorted from over two dozen global victims, CloudSEK has revealed.

The threat intelligence specialist detailed the double cross in a new report, The Gentlemen Files, published on October 5.

They researchers found two exposed servers managed by “Azazel” – an affiliate of The Gentlemen RaaS outfit – containing several terabytes of data stolen from logistics, insurance, pharmaceutical, AI, medical device, and government victims across six countries.

“Azazel was not running a standard affiliate playbook,” the report revealed.

“He built and operated his own independent leak site under the brand Leakned, publishing victim data and collecting extortion proceeds without routing them through the Gentlemen program, a betrayal of the RaaS operator running alongside the betrayal of victims.”

Ukraine grocery chain ATB confirms cyberattack as hackers threaten to leak data

Ukraine’s largest grocery store chain, ATB, confirmed Monday that it was hit by a cyberattack after hackers posted an extortion demand on its website.

The hacker group DataSuckers claimed responsibility for the attack and demanded $400,000, threatening to publish data it claimed to have stolen from millions of ATB customers. A countdown timer for the ransom demand appeared on the retailer’s website but was later removed. The website was unavailable at the time of writing.

ATB denied that customer data had been compromised. The company temporarily took some online services offline for what it described as technical maintenance.

“The temporary message displayed on the website did not affect the security of your data,” ATB said. “The website remains fully under ATB’s control, and all information is securely protected.”

In response to ATB’s statement, the hackers published samples of the allegedly stolen data on their Telegram channel. They said they would not leak the entire database but would instead sell it “for a substantial amount.”