Asos customers have been warned that hackers behind this week's data breach gained access to far more personal information than the retailer first disclosed, according to the BBC. As your consumer watchdog, always checking for scams and risks before they catch you out, this is exactly the kind of update worth taking seriously if you shop with Asos.
The BBC reported it had been contacted by the cyber criminals responsible, who said the breach went beyond the "basic contact details" Asos originally admitted to. Asos has since told customers that hackers now hold detailed profiles including names, addresses, phone numbers, emails, customer numbers and dates of birth. The criminals also have access to customers' search history on the site, with terms such as "reclaimed vintage" and "Asos petite" reportedly visible in the stolen data.
One customer, named Harriet, told the BBC it was "very unsettling" that hackers now know such personal details about her, including how long she has used the site. She said she was worried the stolen data could be used as a tool for future attacks, extending the impact of the breach well beyond the initial incident.
How to spot it
- Unexpected texts, emails or calls claiming to be from Asos
- Messages asking you to change or share your password, even though passwords were not stolen
- Communications creating urgency, such as threats to lock your account within 24 hours
- Messages that use your personal details to appear genuine
What to do if it happened to you
- Asos says customers are not being asked to take any action, but remain cautious of unsolicited messages or calls claiming to be from the company
- Asos says it will never ask customers to share passwords, security codes or payment details through an unsolicited message or call
- Cyber security experts, including Trevor Dearing of Illumio, advise changing your password as a precaution even though passwords were not accessed
- Be alert for suspicious activity on your account
Asos said no bank details or passwords were taken, and that it is still investigating the breach. It said it will contact customers directly where additional support or action is needed. The company said hackers gained access by impersonating a trusted contact to obtain login credentials for an employee account, then used that access to download customer data. The hackers, calling themselves Xuanyewen, claimed to have used a platform called Simon AI built on top of Snowflake, though Snowflake has said its own platform was not breached. Asos said its website and app remain safe to use and that it has already taken extra steps to strengthen its security controls.
Source: BBC
