Online fashion giant Asos has notified its customers that hackers have obtained detailed personal profiles of potentially millions of its users. This warning marks a significant escalation from the retailer’s initial assessment, which suggested only basic contact information might have been compromised during the security breach.
The The compromised records include customer names, physical addresses, telephone numbers, email addresses, and unique customer numbers. Additionally, the hackers captured specific search histories from the platform, revealing user searches for terms such as “reclaimed vintage”, “glamorous wide fit”, and “Asos petite”.
Security experts warn that the exposure of such highly specific retail interests and personal details raises the risk of targeted phishing attacks. Fraudsters can easily use this detailed information to customize deceptive emails or phone calls, making their impersonation attempts appear highly convincing to unsuspecting customers.
In its communication to users, Asos confirmed that detailed profiles were indeed downloaded but emphasized that passwords and banking credentials remained secure. “Please remain cautious of unexpected messages or calls claiming to be from Asos,” the company advised. “We will never ask you to share passwords, security codes or payment details through an unsolicited message or call.” The fashion retailer has not commented on the exact number of users affected by the breach.
The intrusion first became public on Tuesday when cyber criminals manipulated Asos’s internal application system to broadcast a rogue pop-up notification to millions of mobile screens. Following this incident, Asos told shareholders through a London Stock Exchange filing that an “unauthorised third party” had accessed its systems, sending the notification and potentially accessing basic personal details. A similar message was sent to customers shortly after.
The cyber criminals, operating under the name Xuanyewen, reached out to the media on Wednesday evening, providing a sample of the stolen data to demonstrate the scale of the hack. Publication of these findings was delayed to give Asos time to directly alert its customer base first. Asos has stated that its investigation is ongoing and that it will continue to contact individuals if further actions or support are required.
According to Asos, the breach occurred after attackers successfully impersonated a trusted contact to trick an employee into revealing their login credentials. The hackers then used these credentials to access an internal service and extract user data. In their rogue pop-up notification, the hackers claimed to have compromised a Snowflake instance. While Snowflake is a major data storage firm that has seen client compromises from credential stuffing in the past, it previously stated that its own platform had not been breached. The hackers told media they gained entry via Simon AI, a platform natively integrated with Snowflake. Simon AI has been contacted for comment.
Although Asos is not instructing users to take immediate action, cyber security professionals recommend changing passwords as a precautionary measure. Trevor Dearing, Senior Director of Critical Infrastructure at Illumio, advised vigilance. “Passwords have not been stolen, so be highly suspicious of any unsolicited text or email asking you to change or share yours,” Dearing said. “Expect scammers to mention the attack, use your personal details to seem genuine, and create urgency, such as threatening to lock your account within 24 hours.”
Asos has assured the public that both its website and mobile application are secure for continued shopping. “We know our customers trust us with their information,” the firm said in a statement. “We take that responsibility seriously and have already taken additional steps to further strengthen security controls.”
