19 hrs ago
ASOS Hack Exposes Customer Details and Recent Search Histories
Hackers got into some information connected to ASOS customers.
ASOS says they tricked an employee into sharing login details by pretending to be someone the employee trusted.
The hackers accessed names, contact details and some recent searches made on the shopping site.
ASOS says the hackers did not get passwords or payment card information.
The company says its website and app are safe to use.
It warns customers to be careful with unexpected calls, texts and emails claiming to be from ASOS.
Such messages could seem convincing because they may include details about a customer.
ASOS says it is investigating and will contact customers if they need to do anything.
ASOS said an unauthorised party accessed names, addresses, phone numbers, email details and recent customer search histories.
The company said attackers obtained an employee’s login credentials by impersonating a trusted contact.
The credentials were used to access information on certain third-party platforms; ASOS has not confirmed that Snowflake was breached.
ASOS said passwords and payment card information were not accessed, and its website and app remain safe to use.
The company advises customers to be wary of unexpected messages or calls and says it will contact those needing further support.
- Who
- ASOS customers and an ASOS employee account were involved in the incident.
- What
- An unauthorised party accessed customer contact details and recent search histories through information held on certain third-party platforms.
- Where
- Information held on certain third-party platforms used by ASOS was accessed.
- When
- The incident was disclosed after customers received an unauthorised app notification on Thursday (6); ASOS said it conducted a 48-hour investigation.
- Why
- The attackers reportedly impersonated a trusted contact to obtain an employee’s login credentials.
Customer and commercial risks
ASOS’s reassurances and response
Risk from exposed information
Customer and commercial risks
Cybersecurity expert Trevor Dearing warned that criminals could use the information to make fraudulent messages appear genuine.
ASOS’s reassurances and response
ASOS said passwords and payment card details were not accessed, and its website and app remain safe to use.
Potential business impact
Customer and commercial risks
Bloomberg Intelligence analyst Charles Allen warned that lost customer trust could weigh on ASOS’s efforts to rebuild its client base and temporarily limit its recovery.
ASOS’s reassurances and response
ASOS said it took additional steps to strengthen security and would contact customers if further action or support was needed.
Key facts
- Information accessed
- Names, delivery and email addresses, phone numbers and recent search histories
- Information not accessed
- ASOS said passwords and payment card information were not accessed.
- Access method
- An employee account’s login credentials were obtained through impersonation of a trusted contact.
- Systems involved
- ASOS said information on certain third-party platforms was accessed; it has not confirmed a Snowflake breach.
- Customer guidance
- Be cautious of unexpected calls, texts and emails claiming to be from ASOS.
- Company response
- ASOS said affected platforms were locked down and that it was investigating with internal and external cyber experts.
- Customer base
- ASOS reports around 16.5 million active customers across more than 100 markets.
Quotes
ASOS
Online fashion retailer that disclosed the security incident.
“Please remain cautious of unexpected messages or calls claiming to be from Asos. We will never ask you to share passwords, security codes or payment details through an unsolicited message or call.”
easterneye.biz
“We discovered that an unauthorised party gained access to an Asos employee account by impersonating a trusted contact to obtain login credentials.”
easterneye.biz
Charles Allen
Bloomberg Intelligence analyst commenting on possible commercial effects of the breach.
“The loss of customer trust could weigh on efforts to rebuild its client base.”
easterneye.biz
Sources
Related news
Revolut Confirms Sensitive Customer Data Exposed in Government-Email Scam
Genuine Government Email Reportedly Fooled Revolut in Data Breach
Three Indian Researchers Used Claude to Expose OpenAI Vulnerabilities
Researchers Used Claude to Reach OpenAI Internal Systems
OpenAI Apologizes After AI Agent Breached Australian Medicare Portal
Scammers Exploit Demand With Fake Deals for New iPhones
