Asos has warned its customers that a recent cyberattack has compromised a far wider range of personal information than initially disclosed. The online fashion retailer confirmed that hackers now possess names, addresses, phone numbers, emails, customer numbers, dates of birth and even the search terms customers entered on the site.
In an email to shoppers, the company said the breach stemmed from a cybercriminal group that impersonated a trusted contact to obtain login credentials for an Asos employee account. With that access, the attackers downloaded customer data from an unnamed service and later used a platform built on Snowflake, called Simon AI, to retrieve the information.
While Asos confirmed that bank details and passwords were not accessed, security experts warn that the stolen data could be used to craft convincing phishing emails or phone calls. “Expect scammers to mention the attack, use your personal details to seem genuine, and create urgency, such as threatening to lock your account within 24 hours,” said Trevor Dearing, Senior Director of Critical Infrastructure at Illumio.
The company has urged customers to remain cautious of unexpected messages or calls claiming to be from Asos and to change passwords as a precautionary measure. Asos said it is still investigating the breach and will contact customers directly where additional support or action may be required.
