Online fashion retailer Asos has notified customers that a data breach exposed more personal information than initially acknowledged. The company first disclosed the incident this week after cyber criminals used the platform’s app system to send an unauthorized pop-up notification to potentially millions of users.
Asos subsequently updated its breach assessment following contact from BBC News, which received communications from the hackers detailing the extent of compromised data. Customer information now known to be in the hands of the attackers includes names, addresses, phone numbers, email addresses, customer identification numbers, and dates of birth. Additionally, the hackers obtained access to browsing history data, including search terms customers entered on the website. The company confirmed that payment details and passwords were not accessed during the incident.
The attackers, identifying themselves as Xuanyewen, claimed to have gained access through an employee account by impersonating trusted contacts to obtain login credentials. Using these credentials, the group allegedly accessed an unnamed service that provided access to customer data. The hackers claimed in their communications to have compromised a Snowflake instance, referencing a data storage and analysis platform. Asos indicated the unauthorized access occurred through a platform built on top of Snowflake called Simon AI.
Cyber security experts cautioned that stolen personal details could be leveraged for phishing attacks and impersonation scams. The company advised customers to remain suspicious of unsolicited communications claiming to be from Asos and warned that legitimate communications would never request passwords or security codes. Security researchers recommended that users change their passwords and monitor accounts for suspicious activity, while also cautioning against fake messages claiming to be security alerts.
Asos stated that its website and app remain safe for use and that the company has implemented additional security measures. The retailer indicated it would contact customers directly if additional action or support was deemed necessary and that the investigation into the breach was continuing.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI