ASOS confirms customer names and contact details accessed in data breach
Key Points
- ASOS confirmed an attacker accessed customer names and contact details.
- The attacker impersonated a trusted contact to steal an employee’s login.
- ASOS said no payment card details or passwords were accessed.
- The breach surfaced via a rogue “ASOS HACKED” app notification on 6 October.
- The NCSC advises all ASOS customers to assume they are affected.
ASOS has confirmed that an attacker accessed customer names and contact details in a data breach.
The online fashion retailer shared the findings in an email to customers after a 48-hour investigation into an unauthorised app notification sent to shoppers on 6 October.
ASOS said the attacker got into an employee account by impersonating a trusted contact to obtain the employee’s login credentials.
The attacker then used those credentials to access information held on certain third-party platforms that ASOS uses.
“Our investigation found that the unauthorised party had access to some personal information, including names and contact details, and certain non-personal account related information,” said ASOS.
The retailer said its investigation found no evidence that the attacker accessed payment card information or account passwords.
It added that its website and app remained safe to use throughout the incident and are still safe to use.
The breach came to light at around 10am on 6 October, when ASOS app users received a push notification headed “ASOS HACKED”.
The message addressed the retailer’s data protection officer and IT team and claimed the sender had compromised ASOS’s Snowflake data environment.
ASOS told customers at the time to ignore the notification and not to interact with the external link it contained.
The retailer said it locked down the affected platforms immediately and launched an investigation with internal and external cyber security experts.
ASOS is also working with law enforcement and the relevant regulatory authorities.
The company said customers do not need to take any action on their accounts but should stay cautious of unexpected messages or calls claiming to come from ASOS.
“We will never ask you to share passwords, security codes or payment details through an unsolicited message or call,” said ASOS.
The National Cyber Security Centre has advised ASOS customers to assume they are affected by the incident, even if they did not receive the unauthorised notification.
ASOS said it would contact customers directly once its investigation is complete where it believes they need additional information, support or action.
The retailer added that it has already taken further steps to strengthen its security controls.
