Asos Data Breach Exposes More Customer Details Than Initially Disclosed, Investigation Reveals

Asos has acknowledged that hackers accessed a wider range of personal data than originally reported, and the company continues to investigate the breach. The retailer stated it will contact affected customers directly if additional information, support, or action is required.

The UK fashion retailer explained that cyber criminals compromised an employee’s account by impersonating a trusted contact to obtain login credentials. Using this access to an unnamed service, the attackers downloaded customer data.

In a pop-up notification sent to customers, the hackers claimed to have “compromised the Snowflake instance.” Snowflake is a widely used data storage and analytics provider whose clients have previously suffered breaches stemming from unauthorized logins. The hacking group, identifying itself as Xuanyewen, told the BBC they exploited a platform built natively on Snowflake—called Simon AI—to access the data. Simon AI has been contacted for comment, while Snowflake has previously maintained its own platform was not breached.

Asos has advised customers that no immediate action is required on their part. However, cybersecurity experts are urging users to update their passwords as a precaution and remain vigilant for suspicious activity.

“Passwords have not been stolen, so be highly suspicious of any unsolicited text or email asking you to change or share yours,” said Trevor Dearing, Senior Director of Critical Infrastructure at Illumio. “Expect scammers to reference the attack, use your personal details to appear legitimate, and create a false sense of urgency—such as threatening to lock your account within 24 hours.”

Asos confirmed its website and app remain safe to use. “We know our customers trust us with their information,” the company said. “We take that responsibility seriously and have already taken additional steps to further strengthen security controls.”

Source link