ASOS Warns Customers Hackers Have Detailed Profiles of Potentially Millions

ASOS has warned customers that cyber criminals are holding detailed personal profiles belonging to potentially millions of users following a major data breach.

The retailer issued the warning after the BBC was contacted by the hackers behind the attack, who provided a sample of stolen information appearing to show that the breach went considerably further than basic contact details.

Names, addresses, telephone numbers, email addresses and customer numbers are among the information believed to have been accessed.

The stolen data also includes searches made by customers on the ASOS website, potentially revealing information about products and interests they had searched for.

ASOS has confirmed that customer profiles were taken but said bank details and passwords were not accessed.

The company is warning customers to remain alert to possible scams and attempts to impersonate ASOS.

Hackers contact BBC with stolen data

The scale of the breach became clearer after the cyber criminals contacted the BBC and supplied a sample of the information they claim to have stolen.

The BBC delayed publication of its report to allow ASOS to contact customers first.

The information reportedly includes customer searches, meaning criminals could potentially have access to far more detailed information about individuals than previously understood.

Searches reportedly included terms such as "reclaimed vintage", "glamorous wide fit" and "ASOS petite".

While individual searches may appear harmless, combining them with names, addresses, phone numbers and email addresses could give scammers additional information with which to target people.

ASOS warns customers about impersonation scams

ASOS has warned customers that the stolen information could increase the risk of phishing and impersonation attempts.

The company told customers:

"Please remain cautious of unexpected messages or calls claiming to be from ASOS."

It also stressed that it would never ask customers to provide passwords, security codes or payment details through an unsolicited communication.

That warning is particularly important because criminals could potentially use genuine customer information to make fraudulent emails, text messages or phone calls appear more convincing.

A scammer who already knows a customer's name, address or previous shopping activity may be able to create a message that looks considerably more authentic than a generic phishing attempt.

How did the hackers get in?

ASOS says it is still investigating exactly how the breach happened.

The company has told customers that hackers gained access to an ASOS employee account by impersonating a trusted contact and obtaining login credentials.

Once inside an unnamed service, the attackers were able to download customer information.

That explanation suggests the incident involved social engineering, where criminals manipulate or deceive someone into providing access rather than simply breaking through a technical security barrier.

The investigation into how the account was compromised remains ongoing.

The Snowflake connection

The hackers previously used ASOS's own app notification system to claim that they had "compromised the Snowflake instance".

Snowflake is a major data storage and analytics platform used by organisations around the world.

The hackers, who call themselves Xuanyewen, have claimed they used a platform called Simon AI, which is built on top of Snowflake, to gain access to the data.

Those claims have not been independently established.

Snowflake has previously said that its own platform had not been breached.

The exact technical route used to obtain the ASOS information therefore remains part of the ongoing investigation.

The attack first became public through ASOS's own app

The incident attracted widespread attention earlier in the week when cyber criminals appeared to use ASOS's own systems to send a pop-up notification directly to customers.

The message was unusual because it appeared inside the retailer's app rather than being sent privately to the company.

ASOS subsequently told shareholders through the London Stock Exchange that an "unauthorised third party" had sent the notification and that basic personal information, including names and contact details, may have been accessed.

The company's latest warning indicates that the amount of information involved is potentially much greater.

What information was accessed?

ASOS has confirmed that customer data profiles were taken.

Information reported as being in the hackers' possession includes:

• Names

• Addresses

• Telephone numbers

• Email addresses

• Customer numbers

• Website search activity

ASOS has said bank details and passwords were not accessed.

The company has not disclosed the total number of affected customers.

It has also not provided a full explanation of precisely which systems were accessed or how much data was downloaded.

What should ASOS customers do?

ASOS says customers do not need to take any specific action and that its website and app remain safe to use.

However, cybersecurity experts have urged users to remain cautious and consider changing passwords as a precaution.

Customers should be particularly wary of:

• Unexpected emails claiming to be from ASOS

• Telephone calls requesting personal information

• Text messages containing suspicious links

• Requests for passwords or security codes

• Messages asking for payment information

• Communications using genuine personal details to appear legitimate

Customers should avoid clicking suspicious links and should verify unexpected communications through official channels.

A bigger risk than simply losing contact details

The significance of this breach is not simply that criminals may have obtained names and addresses.

The combination of personal information with browsing and search activity could provide criminals with additional material to make targeted scams more convincing.

That creates a different kind of cybersecurity risk.

A generic phishing email can often be identified because it contains little personal information.

A carefully constructed message containing a person's name, address and references to something they genuinely searched for could be much harder to recognise as fraudulent.

That is why ASOS's warning about impersonation attempts is particularly important.

ASOS says security has been strengthened

ASOS has acknowledged the seriousness of the incident and said it has already taken additional steps to strengthen its security controls.

The company said:

"We know our customers trust us with their information."

It added that it takes that responsibility seriously.

The investigation into the breach is continuing.

ASOS has not disclosed the full scale of the incident, and questions remain about exactly how many customers have been affected and precisely how the attackers obtained access.

The Real Terryo view

This incident demonstrates how quickly a cybersecurity breach can move beyond the technical world and become a personal security issue for ordinary customers.

For the people whose information may have been stolen, the concern is not simply whether their data sits on a criminal's computer.

It is what criminals might do with it.

Names, addresses, phone numbers and online activity can potentially be combined to create convincing impersonation attempts.

That means customers need to be alert even if their bank details and passwords were not accessed.

The ASOS breach is still developing, but the message for customers is already clear: treat unexpected communications with caution and never provide passwords, security codes or payment information in response to unsolicited contact.