ASOS confirms customer contact details accessed in cyber incident

Asos confirmed that an unauthorised notification was sent to customers at about 10am BST on 6 October. The retailer said it was investigating activity involving third-party platforms used to communicate with customers and had restricted access to its notification systems. The UK’s National Cyber Security Centre (NCSC) advises all Asos customers to assume they may be affected, even if they did not receive the alert. That is precautionary advice, not a finding that every customer’s data was accessed. [1] [3]

Asos said names and contact details may have been accessed, but it did not believe payment-card information or account passwords were affected. At the time of its statement, Asos said its website and app were operating normally. [1] [2]

The notification claimed that a Snowflake data environment had been fully compromised and threatened to leak information. Sending the notification does not, by itself, establish that claim or show that customer records were stolen. Snowflake told Reuters it had found no compromise of its platform, a statement that does not settle whether an individual Asos account was accessed. [5] [6]

Asos has told customers to disregard the notification and avoid its external link. It is not currently asking them to change their Asos passwords, while the NCSC advises them to watch for suspicious messages and avoid suspicious links, including those in push notifications. [2] [3]

Update

ASOS said on Thursday that its investigation had found an unauthorised party had accessed customers’ names, delivery addresses, email addresses and phone numbers. Earlier in the week, the retailer had said it was still investigating whether customer data had been stolen. [8] [9]

In a customer message quoted by The Guardian, ASOS said the intruder impersonated a trusted contact to obtain login credentials for an employee account, then used them to access information on third-party platforms used by the retailer. [9]

The Guardian says recent searches in the ASOS app are understood to be among other information accessed, citing earlier BBC reporting after the hackers contacted the broadcaster. ASOS described that information more generally as “certain non-personal account related information”. [9]

ASOS said payment-card details and passwords had not been accessed. It said customers did not need to take action, but warned them to be wary of unexpected messages or calls claiming to be from the company. [9]