ASOS Warns Customers That Hackers May Have Accessed Detailed User Profiles

ASOS has warned customers that cybercriminals may have obtained detailed profiles of potentially millions of online shoppers.

The retailer issued the update after BBC News told ASOS that hackers had contacted the broadcaster, claiming the breach involved more than the “basic contact details” the company had previously said may have been accessed.

What ASOS customer data may have been exposed?

The stolen information reportedly includes customers’ names, addresses, phone numbers, email addresses and customer numbers.

It may also include searches customers performed on the ASOS website, with exposed terms including “Reclaimed Vintage”, “Glamorous Wide Fit” and “Athos Petite”.

Cybercriminals could use this information to create more convincing phishing emails and phone calls tailored to individual customers.

ASOS said the increased risk means customers should be alert to possible identity fraud.

ASOS says passwords and bank details were not accessed

In an email to customers, ASOS confirmed that data profiles had been captured but said it had not accessed bank details or passwords.

“Please be careful about unexpected messages or phone calls claiming to be from ASOS,” the company said.

“We will never ask you to share your password, security code or payment details through unsolicited messages or phone calls.”

ASOS did not respond to questions about the scale of the breach.

How the ASOS breach happened

The high-profile hack made global headlines on Tuesday, when cybercriminals used ASOS’s app system to send pop-up notifications to potentially millions of people.

Later that day, ASOS confirmed to shareholders through the London Stock Exchange that the pop-up had been sent by an “unauthorized third party”. The company said “basic personal information, including name and contact details, may have been accessed”.

ASOS then sent customers an email containing similar wording.

On Wednesday night, the perpetrators contacted the BBC and shared samples of stolen data that appeared to show the wider scope of the hack.

The BBC delayed publication of this article to allow ASOS to contact customers first.