Asos has informed its customers that hackers are in possession of detailed profiles of potentially millions of the online retailer's users. This update came after BBC News contacted the retailer, reporting that cybercriminals had claimed the breach went beyond "basic contact details" that Asos had previously stated might have been accessed.
Names, addresses, phone numbers, emails, and customer numbers are now in the hands of cybercriminals. The searches customers have made on the website are also visible in the data, with terms such as "reclaimed vintage", "glamorous wide fit", and "Asos petite" appearing.
This information could enable scammers to craft effective phishing attack emails or phone calls, increasing the risk to individuals and leading to warnings about potential impersonation scams.
In an email to customers, Asos confirmed that data profiles were taken but stated that no bank details or passwords were accessed. The company advised customers to "remain cautious of unexpected messages or calls claiming to be from Asos" and reiterated that they "will never ask you to share passwords, security codes or payment details through an unsolicited message or call."
The company did not respond to questions regarding the scale of the breach.
The high-profile hack gained global attention on Tuesday when cybercriminals utilized Asos's own app system to send a pop-up notification to potentially millions of users. Later that day, the firm confirmed to shareholders via the London Stock Exchange that the pop-up was sent by an "unauthorised third party" and that "basic personal information including name and contact details may have been accessed."
The company then sent an email to customers with similar wording. On Wednesday evening, the cybercriminals responsible contacted the BBC, sharing a sample of the stolen data that revealed the true extent of the hack.
Asos confirms hackers sent 'unauthorised' notification to app users What can I do to protect myself after 'Asos hacked' message?
