ASOS hackers reportedly took more personal data than first realised as company updates customers

ASOS issued an update to customers in an email on Thursday, detailing the first findings of their investigation into Tuesday’s hack.

The fast fashion retailer confirmed “names and contact details” had been taken as well as “certain non-personal account related information”, which is reportedly customers’ search history details.

The hackers reportedly contacted BBC to say the data breach went beyond the “basic contact details” ASOS first told customers they had been able to access.

It’s understood that armed with the specific search terms used by customers, such as  “reclaimed vintage”, “glamorous wide fit” and “ASOS petite”, the scammers could create highly personalised and sophisticated phishing emails or phone calls.

While the UK-based company with 16.4 million active users worldwide has not confirmed this level of breach, they have warned customers to be vigilant about imposters as they continue their investigation.

“Please remain cautious of unexpected messages or calls claiming to be from ASOS,” the email to customers warned.

“We will never ask you to share passwords, security codes or payment details through an unsolicited message or call.”

Steve Hunter, director of engineering at cybersecurity firm Arctic Wolf, told nine.com.au there were ways customers could protect themselves.

“For ASOS customers, the most important thing is to remain vigilant without panicking," Hunter said.

"Do not click on links contained in unexpected app notifications, emails or text messages claiming to be from ASOS. Be cautious of anyone creating a sense of urgency or asking for personal information, passwords, or payment details.

"Instead, go directly to the official ASOS website or app for updates."

Hunter added that as a precaution, “customers should consider changing their ASOS password, particularly if it has been reused across multiple services” and consider enabling authentication wherever available.

Staff accounts compromised

The brand confirmed that “the unauthorised party had access to some personal information” but this did not include customer payment card information or account passwords.

They say the website and app remain safe to use but the £602 million ($1.15 billion) company has taken a hit on the share market in the days since the hack.

Stocks fell by about a tenth following the threatening app alert, sent to customers in Australia, the UK and other parts of the world, before regaining a little on Thursday.

“ASOS hacked,” the alert, which was sent about 8pm AEST on Tuesday read.

“Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.”

The link at the bottom of the alert sent people to a newly created channel on messaging app Telegram, labelled Xuanye group gateway.

Cloud data storage company Snowflake told nine.com.au they haven’t found any compromise to their platform despite the hackers claims.

"We can confirm this issue did not in any way result from a vulnerability, weakness, flaw, or misconfiguration with the Snowflake service, platform, or internal environments, and was not caused by Snowflake," a spokesperson told nine.com.au.

“No remediation is required for Snowflake customers.”

It was later discovered the hackers had infiltrated Snowflake by hacking into ASOS staff accounts.

“We discovered that an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain log in credentials,” the brand said.

“Those credentials were then used to access information on certain third-party platforms used by ASOS.”

It’s not known how many of the company’s 2800 staff accounts were impacted in the breach and exactly what information was accessed.