ASOS breach: customer names and contact details accessed
An unauthorised party impersonated a trusted contact to obtain an employee's login credentials, then used them to reach customer information held on third-party platforms.
What happened
ASOS said an unauthorised party impersonated a trusted contact to obtain an employee's login credentials, then used them to reach customer information held on third-party platforms the retailer uses. The incident surfaced on October 6, when an unauthorised “ASOS HACKED” notification was sent through the company's own app.
Who is affected
Customer names and contact details. BBC reporting on a sample the attackers shared also lists home addresses, phone numbers, email addresses, and website search history; ASOS has not confirmed that sample and has not published how many customers are affected. ASOS says payment card information and account passwords were not accessed.
How serious
Names and contact details are enough for targeted phishing: scam messages and calls that use your real name and claim to be from ASOS, asking for passwords, security codes or payment details. ASOS says payment card information and account passwords were not accessed.
What to do now
ASOS says customers do not need to take action on their accounts, but should stay cautious of unexpected messages or calls claiming to be from ASOS. The company says it will never ask for passwords, security codes, or payment details through an unsolicited message or call — open the app or site yourself instead of using links in messages.
Sources: ASOS Plc statement (LSE RNS, Oct 6) · TechCrunch · Reuters