Cyber Awareness
Asos Confirms Hack Exposed More Personal Data Than Initially Reported
By Today News Hours Editorial Desk
Asos has warned its customers that hackers now possess detailed profiles of potentially millions of users. The retailer issued the update after BBC News reported that cyber criminals claimed the breach extended beyond the “basic contact details” Asos had previously said might have been accessed. Names, addresses, phone numbers, emails, customer numbers and even customers’ search queries on the site—such as “reclaimed vintage,” “glamorous wide fit” and “Asos petite”—are now in the hands of the attackers. With this information, scammers could craft targeted phishing emails or phone calls, raising the risk of impersonation scams.
In an email to customers, Asos confirmed that data profiles were taken but that no bank details or passwords were accessed. The company urged customers to remain cautious of unexpected messages or calls claiming to be from Asos, reminding them that the company would never ask for passwords, security codes or payment details through unsolicited communication.
The high‑profile hack made global headlines on Tuesday when cyber criminals used Asos’s own app system to send a pop‑up notification to potentially millions of people. Later that day the firm confirmed to shareholders via the London Stock Exchange that the pop‑up was sent by an “unauthorised third party” and that “basic personal information including name and contact details may have been accessed.” The company then sent a similar email to customers.
On Wednesday evening the attackers contacted the BBC and shared a sample of the stolen data, revealing the true extent of the breach. The BBC held off publishing the story to allow Asos to notify its customers first.
Asos said it is still investigating how the hack occurred. It explained that hackers “gained access to an Asos employee account by impersonating a trusted contact to obtain login credentials.” With that login to an unnamed service, the attackers were able to download the customer data. In the pop‑up notification sent to customers, the attackers claimed they had “compromised the Snowflake instance.” Snowflake is a popular data‑storage and analysis company that has previously been breached due to unauthorised logins. The attackers, calling themselves Xuanyewen, said they used a platform built natively on top of Snowflake—called Simon AI—to gain access to the data. Simon AI has been contacted for comment. Snowflake previously stated its platform had not been breached.
Asos said customers are not being asked to take any action. Cyber‑security experts have advised users to change passwords as a precaution and remain alert for suspicious activity. Asos assured customers that its website and app are safe to use and that it has taken additional steps to strengthen security controls.
Sources: Asos, BBC News, London Stock Exchange, Snowflake.