Asos has confirmed that hackers accessed far more personal information than the retailer initially disclosed after a breach this week.
The company told customers on Wednesday evening that criminals now possess names, addresses, phone numbers, email addresses, customer numbers and dates of birth for potentially millions of users. Asos had previously stated only "basic contact details" might have been compromised.
The BBC learned of the expanded breach when cyber criminals contacted the news organization with stolen data samples. The hackers, who identified themselves as Xuanyewen, also accessed customer search histories on the Asos website, including queries for specific product types.
Asos confirmed that no bank details or passwords were accessed. The company said hackers obtained an employee's login credentials by impersonating a trusted contact, then used that access to download customer data from an unnamed service. In a pop-up notification sent to users via the Asos app on Tuesday, the hackers claimed they had "compromised the Snowflake instance." Snowflake is a cloud data storage platform. The criminals said they used a platform called Simon AI, built on Snowflake, to access the data. Snowflake has previously stated its platform was not breached.
Trevor Dearing, Senior Director of Critical Infrastructure at Illumio, warned that scammers may use the stolen personal details to create convincing phishing attacks and fraudulent calls. He advised customers to be highly suspicious of unsolicited messages asking them to change passwords, since passwords were not stolen.
One affected customer told the BBC she found it "very unsettling" that hackers know her account history dating to 2019. She expressed concern that stolen data could be weaponized for future attacks beyond the immediate breach.
Asos advised customers to remain cautious of unexpected messages claiming to be from the company and said it will not request passwords, security codes or payment details through unsolicited contact. The company said its website and app remain safe to use and that it has taken additional security measures. Asos did not disclose the total number of affected users.