Asos issues warning after 'full extent' of data breach emerges
Hackers accessed the Asos customer database on Tuesday, accessing information such as names, addresses and phone numbers as well as search terms, the BBC revealed
Asos has issued a warning to customers after it revealed the full extent on the data breach earlier this week. The retailer says hackers are in possession of detailed profiles of potentially millions of its users. The news emerged after the hackers reportedly contacted the BBC claiming the data breach went beyond "basic contact details" that Asos previously said they may have accessed. The cyber criminals claim they have names, addresses, phone numbers, emails and customer numbers.
The BBC reports that customer searches are also in the hands of cyber criminals. Terms such as "reclaimed vintage", "glamorous wide fit" and "Asos petite" are included in the data. It means the criminals may be able to use the data to create pishing emails or calls to target the customers. It means the risk to individuals is higher than previously thought. Asos is now warning customers to watch out for potential impersonation scams.
It however says no bank details or passwords were accessed by the cyber attackers. In an email to customers, it said: "Please remain cautious of unexpected messages or calls claiming to be from Asos. "We will never ask you to share passwords, security codes or payment details through an unsolicited message or call." Asos is yet to comment on the scale of the data breach. But the hack made global news on Tuesday when the hackers issued a notification to those with the Asos app.
The firm later told shareholders that the message was issued by an "unauthorised third party" and claimed that "basic personal information" had been accessed. The BBC however says the cyber criminals contacted the broadcaster on Wednesday showing the extent of the data they had accessed. Asos is said to be investigating how the hack happened. It is believed that the hackers gained access to an "employee account by impersonating a trusted contact to obtain log in credentials".
It is thought this was then used to download customer data. A notification sent to customers then said the attackers had "fully compromised the Snowflake instance". It went on to demand the company "engage" with the hackers or they will leak the information. Snowflake is a popular data storage and analysis company. The BBC says it has previously said its platform had not been breached. Asos says customers don't need to take action at the moment.
Its email to customers says it is still investigating and will contact people should they find "additional information, support or action may be required". It added: "We know our customers trust us with their information. We take that responsibility seriously and we have already taken additional steps to strengthen our security controls." Ensure our latest news and sport headlines always appear at the top of your Google Search by making us a Preferred Source.