Asos Reports Customer Data Breach by Impersonating a Trusted Contact

Hackers infiltrated Asos by masquerading as a trusted contact, allowing them to access an employee's account and obtain customer names and contact details, the retailer disclosed. The breach affected the personal information of millions of customers.

Customers using Asos's app received a notification titled “Asos hacked,” linking to the Telegram messaging service, which led to a significant drop in the company's share value. Following a comprehensive 48-hour investigation, Asos confirmed that basic customer information, such as names and contact details, was compromised. Additionally, some non-personal account information was accessed, though specifics were not provided. However, payment card details and passwords were not affected.

Asos announced that an unauthorized party had impersonated a trusted contact to obtain login credentials, which were then used to access certain third-party platforms utilized by Asos. The affected platforms were immediately secured to prevent further access, and a thorough investigation was initiated with both internal and external cybersecurity experts. The company is also cooperating with law enforcement and regulatory bodies.

Asos reassured customers that their website and app remain secure, advising no immediate action is necessary. They have enhanced security measures to prevent future incidents. Customers are advised to be vigilant against unexpected messages or calls from individuals claiming to be from Asos, as the company will never solicit passwords, security codes, or payment details via unsolicited communications.

Asos committed to notifying customers directly upon the completion of their investigation, especially if further information, support, or action is required. The Telegram channel used by the hackers, who identify as the Xuanye Group, assured customers that payment information was not compromised. Cybersecurity experts noted that this group was previously unknown and suggested the notification might be an attempt to gain attention.