Hackers have obtained detailed profiles of millions of Asos customers, including names, addresses, phone numbers, emails, customer numbers, dates of birth, and even search histories on the website. The breach came to light after the BBC contacted Asos on Wednesday, reporting that cybercriminals claimed to have far more sensitive information than the “basic contact details” the retailer initially acknowledged.
The stolen data revealed searches for terms like “reclaimed vintage,” “glamorous wide fit,” and “Asos petite,” along with the year customers first used the site. One victim, Harriet, who has been shopping on Asos since 2019, told the BBC she found it “very unsettling” that hackers now know these details. She warned the stolen data could be “used as a tool for future attacks,” extending the impact beyond the immediate breach.
The cybercriminals also gained access by impersonating a trusted contact to obtain login credentials for an Asos employee account. This access allowed them to download customer data from a service connected to Snowflake, a data storage and analytics company. The hackers, who call themselves Xuanyewen, claimed to have exploited Simon AI, a platform built on top of Snowflake, to infiltrate Asos's data. Snowflake has denied that its platform was breached.
The breach became public on Tuesday when hackers used Asos’s app to send a pop-up notification to millions of users, announcing the intrusion. Asos confirmed the incident to shareholders through the London Stock Exchange that day, describing it as an “unauthorised third party” attack and stating that “basic personal information including name and contact details may have been accessed.” The company sent a similar email to customers.
Asos said no bank details or passwords were taken. It asked customers to “remain cautious of unexpected messages or calls claiming to be from Asos” and stated it would “never ask you to share passwords, security codes or payment details through an unsolicited message or call.” The company is continuing to investigate the breach and plans to contact customers “where we believe additional information, support or action may be required.”
Security experts have urged caution. Trevor Dearing, Senior Director of Critical Infrastructure at Illumio, said users should be wary of phishing attempts that mimic the attack. “Passwords have not been stolen, so be highly suspicious of any unsolicited text or email asking you to change or share yours,” he said. “Expect scammers to mention the attack, use your personal details to seem genuine, and create urgency, such as threatening to lock your account within 24 hours.”
Asos stated that its website and app remain safe to use and that it has “already taken additional steps to further strengthen security controls.” The company did not disclose the total number of affected customers.
The breach raises questions about the security of third-party platforms like Snowflake, which have been targeted in recent cyberattacks. Asos’s experience adds to a growing list of high-profile retail hacks involving unauthorised access through employee accounts.
The impact of the stolen data may unfold over months or years as scammers attempt to exploit the detailed customer profiles. The incident exposes how much personal information is collected and stored by online retailers and how that data can be weaponised when breached.
According to Joy Online.
