Asos Data Breach Exposes Millions of Customer Records Including Search Histories
Developing story first seen 52 minutes ago
Asos has now confirmed that hackers accessed customer search histories alongside personal data—far more than initially disclosed. The fashion retailer previously said only "basic contact details" were compromised, but cyber criminals who contacted the BBC showed they possessed names, addresses, phone numbers, emails, customer numbers and search terms like "plus size", "glamorous wide fit" and "reclaimed vintage". No passwords or bank details were taken, but the stolen information gives scammers ammunition to craft convincing phishing attacks using customers' shopping behaviour and personal details.
How the breach occurred has also emerged: hackers impersonated a trusted contact to obtain an Asos employee's login credentials, then used that access to download customer data from a Snowflake-based platform called Simon AI. The cyber criminal group calling themselves Xuanyewen sent the initial pop-up notification to millions on Tuesday, then provided evidence of their access to the BBC, forcing the company to acknowledge the true scope. Cybersecurity experts have warned users to be highly suspicious of any unsolicited messages claiming to be from Asos and asking them to change passwords, as scammers will likely exploit the breach to impersonate the company.
- Asos confirms hackers accessed search histories and personal data of millions
- Cyber criminals proved the breach went far beyond initial company disclosures
- Experts warn of phishing scams using stolen personal details and shopping behaviour
New here? Start with this
Asos is one of the world's largest online fashion retailers, serving millions of customers globally who buy clothes, shoes and accessories through its website and app. A cyber attack has compromised personal information held by the company, affecting a significant portion of its customer base and raising concerns about data security in the retail sector.
The breach exposed more than basic contact details, including customers' detailed shopping search histories that reveal their style preferences and interests. This information was more extensive than Asos initially acknowledged, only becoming fully apparent when a cyber criminal group shared evidence of the incident with BBC journalists.
The exposure of personal data combined with shopping behaviour records creates risks for customers, who could face targeted fraud attempts or unwanted contact. It also damages trust in the retailer's ability to protect customer information, a critical concern for any company operating online.
Coverage
- The Guardian — Asos confirms customer details and app searches exposed in cyber attack
- BBC Technology — Asos says hackers accessed millions of customer profiles in data breach