Asos disclosed to customers this week that hackers obtained far more personal data than the retailer initially acknowledged after a BBC investigation.
The online fashion retailer first told shareholders and customers on Tuesday that a pop-up notification sent via its app by an "unauthorised third party" meant "basic personal information including name and contact details may have been accessed." That account proved incomplete.
After cyber criminals contacted the BBC on Wednesday with samples of stolen data, Asos issued a revised statement confirming the breach included names, addresses, phone numbers, email addresses, customer numbers and dates of birth. The hackers also obtained records of customer searches on the Asos website and the length of time individual customers had used the platform. The company reaffirmed that bank details and passwords were not taken.
Asos said it did not know the scale of the breach and declined to estimate how many users were affected, though the initial pop-up notification reached "potentially millions."
The attack began when cyber criminals impersonated a trusted contact to obtain login credentials for an Asos employee account. Using that access, the hackers downloaded customer data from an unspecified service. In the pop-up message, the criminals claimed they had "compromised the Snowflake instance," referring to a data storage and analysis platform. The group calling itself Xuanyewen told the BBC they used Simon AI, a platform built on top of Snowflake, to access the data. Snowflake previously stated its platform had not been breached. Simon AI did not respond to a request for comment.
Asos advised customers not to take action and said its website and app remain safe. However, cybersecurity experts recommended changing passwords as a precaution and watching for suspicious activity. With stolen personal details and search history in criminals' hands, victims face heightened risk of phishing attacks and impersonation scams. Asos warned customers to be wary of unsolicited messages or calls claiming to be from the company.