Asos warns customers about full extent of data breach after BBC contacted by hackers

Asos has warned its customers that hackers now possess detailed profiles of potentially millions of its users after the retailer was informed by the BBC that cyber criminals had contacted the broadcaster. The company said the breach extends beyond the “basic interaction details” it previously disclosed, with names, addresses, telephone numbers, email addresses and order numbers now in the hands of attackers. In addition, the search terms shoppers have entered on the site—such as “reclaimed vintage”, “glamorous wide fit” and “Asos petite”—are also part of the stolen data, according to the hackers. Asos warned that this information could enable scammers to craft convincing phishing emails or telephone calls, raising the risk of impersonation fraud. In its customer email, the retailer confirmed that profile information had been taken but stressed that no bank details or passwords were accessed. “Please stay cautious of unexpected messages or calls claiming to be from Asos,” the message read. “We will never ask you to share passwords, security codes or payment details via an unsolicited connection or call.” Asos declined to comment on the scale of the incident when approached for further details. The incident first gained attention on Tuesday when attackers used the retailer’s own app infrastructure to push a pop‑up notification to potentially millions of users. Later that day, Asos told shareholders through the London Stock Exchange that the pop‑up originated from an “unauthorised 3rd party” and that “basic personal information including name and contact details” may have been accessed. A follow‑up email to customers echoed that wording. On Wednesday evening, the cyber criminals responsible contacted the BBC, providing a screenshot that illustrated the full scope of the data taken. The BBC delayed publication of its report to allow Asos to notify its affected users first. Read the full story at BBC News →