Denmark, ASOS, ATB and Osaka University breaches in Check Point’s weekly report
Four organisations in four countries are named in the top breaches of Check Point Research’s 12th October Threat Intelligence Report: Denmark’s government, UK retailer ASOS, Ukrainian grocer ATB and Osaka Metropolitan University. The report describes them as reported incidents; several details are claims by attackers and have not been confirmed by the victims. None of the entries mentions a CVE, so this is a data breach roundup rather than a patching alert.
What we know
- Denmark: the government disclosed a breach involving its Central Register of Persons after unauthorized individuals exploited access that had been provided to a private supplier. Check Point says the incident reportedly exposed names, addresses and identification numbers linked to approximately 8.8 million people in the registry.
- ASOS: the UK online fashion retailer confirmed a cyberattack involving stolen employee credentials, which enabled unauthorized access to third-party platforms. Attackers reportedly obtained customer names and contact details and sent unauthorized push notifications to users of the mobile app. A group called Xuanye claimed responsibility.
- ATB: Ukraine’s largest grocery retailer faced a cyberattack that disrupted its online services after attackers posted an extortion demand on its website. A group called DataSuckers claimed to have stolen records for 7.9 million customers, including names, addresses, passport information and order records.
- Osaka Metropolitan University: the university suffered a suspected ransomware attack that disrupted classes, internal networks, email and administrative systems. About 500 servers were affected, and personal information on at least 130,000 people may have been exposed.
Who is affected
The largest reported exposure is in Denmark, where the registry data covers roughly 8.8 million people. ATB’s claimed 7.9 million customer records would be similar in scale, but that figure comes from the attackers. At ASOS, the confirmed element is the credential-based access to third-party platforms; the customer data exposure is described as reported. At Osaka Metropolitan University, the 130,000 figure is a possible minimum, and staff, students and applicants are not broken down in the report.
What has not been confirmed
- The Xuanye and DataSuckers claims are attacker statements. The report does not say the victims have verified them.
- Which supplier was involved in the Danish incident, and how the access was obtained, is not disclosed in the report.
- The university attack is described as suspected ransomware; no group or ransom demand is named.
- Whether any of the stolen data has been published or sold is not disclosed.
Why this matters
This section is our analysis, not new reporting. Three of the four incidents run through access held by someone other than the victim: a supplier’s access in Denmark, stolen employee credentials reaching third-party platforms at ASOS, and, at ATB, an extortion demand that put pressure on a customer-facing service. For a typical organisation, the lesson is that vendor and SaaS access paths are as exposed as your own perimeter. The ASOS push notifications also show that a compromised marketing or messaging platform can reach customers directly, which makes phishing built on a real brand more convincing.
What to do
- Review which suppliers hold standing access to systems with personal data. Remove accounts you cannot justify and require MFA on the rest.
- Check third-party and SaaS platforms, including push notification and messaging tools, for logins from unfamiliar locations or devices, and rotate credentials for staff who may have been phished.
- Hunt for credentials of your employees appearing in infostealer or leak feeds, and force resets where they do.
- If you are a customer or registry resident of an affected organisation, watch for phishing that uses your name, address or order details, and do not act on unexpected push notifications or links.
- Confirm that backups and recovery plans for email and administrative systems work offline, since the Osaka incident disrupted both.
- Read the full Check Point bulletin and follow each organisation’s own notices as they confirm details.
