Although the apparent extortion message has been sent directly to customers, it is addressed to Asos' data protection officer (DPO) and IT team.