Asos has confirmed that hackers obtained far more personal data than the retailer initially disclosed following a breach this week. The online fashion retailer first said only "basic contact details" may have been accessed after cyber criminals sent an unauthorized pop-up notification to potentially millions of users on Tuesday. BBC News reporting prompted the company to issue an updated statement Wednesday revealing the actual scope of the theft.
Names, addresses, phone numbers, email addresses, customer account numbers and dates of birth are now in the hands of criminals, Asos confirmed. The hackers also obtained records of searches customers performed on the website, including specific product queries. One customer told the BBC the disclosure was "very unsettling" given how much personal information the criminals now possess.
Asos said in communications to customers that bank details and passwords were not accessed. The company stated no action is required from users, though cybersecurity experts have recommended changing passwords as a precaution and remaining alert for suspicious activity.
The breach occurred after cyber criminals impersonated a trusted contact to obtain login credentials for an Asos employee account, according to the company. Using those credentials, the hackers accessed an unnamed service and downloaded customer data. The criminals, calling themselves Xuanyewen, claimed to the BBC they used a platform called Simon AI, which runs on Snowflake data storage infrastructure, to gain access.
Asos said its website and app remain safe to use. The company is investigating the breach and will "contact customers directly where we believe additional information, support or action may be required."
Security experts warned that scammers could use the stolen personal details to craft convincing phishing attacks and impersonation schemes. Trevor Dearing, Senior Director of Critical Infrastructure at Illumio, cautioned that fraudsters may reference the attack and use victims' own personal information to seem credible. Asos advised customers to disregard any unsolicited messages claiming to be from the company and asking for passwords or payment details.