ASOS confirms customer contact details accessed in cyber incident

Asos confirmed that an unauthorised notification was sent to customers at about 10am BST on 6 October. The retailer said it was investigating activity involving third-party platforms used to communicate with customers and had restricted access to its notification systems. The UK’s National Cyber Security Centre (NCSC) advises all Asos customers to assume they may be affected, even if they did not receive the alert. That is precautionary advice, not a finding that every customer’s data was accessed. [1] [3]

Asos said names and contact details may have been accessed, but it did not believe payment-card information or account passwords were affected. At the time of its statement, Asos said its website and app were operating normally. [1] [2]

The notification claimed that a Snowflake data environment had been fully compromised and threatened to leak information. Sending the notification does not, by itself, establish that claim or show that customer records were stolen. Snowflake told Reuters it had found no compromise of its platform, a statement that does not settle whether an individual Asos account was accessed. [5] [6]

Asos has told customers to disregard the notification and avoid its external link. It is not currently asking them to change their Asos passwords, while the NCSC advises them to watch for suspicious messages and avoid suspicious links, including those in push notifications. [2] [3]

Update

ASOS said on Thursday that its investigation had found an unauthorised party had accessed customers’ names, delivery addresses, email addresses and phone numbers. Earlier in the week, the retailer had said it was still investigating whether customer data had been stolen.