Asos Warns Customers of Expanded Data Breach
Fashion retailer reveals hackers accessed detailed customer profiles after initial reports suggested only basic contact information was compromised.
Online fashion retailer Asos has informed customers that hackers possess detailed profiles of potentially millions of users, a significant expansion on the initial assessment of the data breach. This update follows contact from cybercriminals by the BBC, who indicated the breach extended beyond "basic contact details".
The compromised data includes customer names, addresses, phone numbers, email addresses, and customer numbers. Additionally, information about customer searches on the Asos website, such as terms like "reclaimed vintage," "glamorous wide fit," and "Asos petite," has been accessed. This information could enable scammers to craft more convincing phishing attacks via email or phone calls, increasing the risk of impersonation scams.
Asos confirmed in an email to customers that the data profiles were taken but stated that no bank details or passwords were accessed. The company advised customers to remain cautious of unexpected messages or calls claiming to be from Asos, emphasizing that the company will not request passwords, security codes, or payment details through unsolicited communications.
The breach first came to public attention when cybercriminals used Asos's own app system to send a pop-up notification to potentially millions of users. At the time, the company confirmed to shareholders via the London Stock Exchange that an "unauthorised third party" had sent the notification and that "basic personal information including name and contact details may have been accessed."