Customers have been informed that their payment details and passwords were not compromised following a breach of an employee account at Asos. Hackers gained access to names and contact details of millions of customers by impersonating a "trusted contact" to infiltrate one of its employee's accounts.
Incident Overview
On Tuesday, thousands of users of the online fashion retailer's app received a notification titled "Asos hacked," which included a link to the Telegram messaging service. This news caused Asos shares to drop by approximately 10%.
After conducting a detailed 48-hour investigation, Asos confirmed that basic personal information, including names and contact details, had been accessed by an unidentified third party. The retailer noted that the hackers also gained access to "certain non-personal account related information," although it did not specify what this entailed.
Company Statement
In a message to customers on Thursday, Asos stated:
“"We discovered that an unauthorized party gained access to an Asos employee account by impersonating a trusted contact to obtain login credentials. Those credentials were then used to access information on certain third-party platforms used by Asos."
