Asos revealed to customers this week that hackers obtained far more personal information than the retailer initially disclosed following a data breach that exposed potentially millions of user profiles.
The online fashion retailer first confirmed Tuesday that an "unauthorised third party" accessed "basic personal information including name and contact details." On Wednesday, after BBC News reported that cyber criminals had contacted the broadcaster with samples of stolen data, Asos issued an updated statement acknowledging that hackers now possess names, addresses, phone numbers, email addresses, customer numbers, dates of birth, and records of customer searches on the website.
Asos said no bank details or passwords were accessed. The company told shareholders via the London Stock Exchange that hackers gained entry by impersonating a trusted contact to obtain login credentials for an unnamed employee account, then used those credentials to download customer data from a Snowflake data storage system.
Cyber criminals calling themselves Xuanyewen claimed they accessed the data through a platform built on Snowflake called Simon AI. Snowflake has previously stated its platform has not been breached. Asos said it continues investigating the incident.
The breach originated when attackers sent a pop-up notification to potentially millions of users through Asos's own app system on Tuesday, alerting users that their data had been compromised. The criminals used this same notification to claim they had "compromised the Snowflake instance."
With detailed customer profiles, scammers may craft convincing phishing emails or calls impersonating Asos or using personal details to appear legitimate. Security experts warned customers to remain suspicious of unsolicited messages requesting passwords or security codes, since those were not stolen. Asos advised users to change passwords as a precaution and monitor accounts for suspicious activity.
One affected customer told the BBC the breach was "very unsettling" and expressed concern that stolen data could fuel future attacks beyond the initial incident. Asos said the website and app remain safe to use and that it has strengthened security controls.