Asos has informed its customers that hackers are in possession of detailed profiles of potentially millions of users. This update follows a notification from BBC News, which revealed that cyber criminals claimed this week's breach involved more than just "basic contact details" previously mentioned by Asos.
What Was Compromised
The stolen data includes:
- Names
- Addresses
- Phone numbers
- Emails
- Customer numbers
- Search terms made by customers on the website, such as "reclaimed vintage", "glamorous wide fit", and "Asos petite".
With this information, scammers may craft effective phishing emails or phone calls, increasing the risk of impersonation scams. In an email to customers, Asos confirmed that while data profiles were taken, no bank details or passwords were accessed.
“"Please remain cautious of unexpected messages or calls claiming to be from Asos," the company advised. "We will never ask you to share passwords, security codes or payment details through an unsolicited message or call."
Details of the Breach
The breach gained significant attention on Tuesday, when hackers used Asos's own app system to send a pop-up notification to millions of users. Later that day, the firm confirmed to shareholders via the London Stock Exchange that the pop-up was sent by an "unauthorised third party" and that basic personal information may have been accessed.
