ASOS Breach Exposed Customer Details and Website Search History

Summary

Attackers used stolen employee credentials to access ASOS customer information, including contact details, dates of birth, and website searches. ASOS says passwords and payment card data were not accessed and has secured affected platforms.

Key points

Attackers reportedly tricked an ASOS employee into disclosing login credentials and used them to access customer information on third-party platforms.
Exposed information includes names, addresses, phone numbers, email addresses, customer numbers, dates of birth, and ASOS website searches.
ASOS says customer passwords and payment card information were not accessed.
The attackers reportedly sought a ransom and threatened to release the data; ASOS has not disclosed whether it will pay.
ASOS says it locked down affected platforms, strengthened security controls, and is investigating with internal and external specialists.
The stolen details and search history could make targeted phishing more convincing; customers are advised to verify messages through ASOS’s website or app.

Article Details

Victim Organization: ASOS
Incident Type: Data breach following an employee being tricked into handing over login credentials, which were used to access customer information on third-party platforms.
Data Types Exposed: Names
Home addresses
Phone numbers
Email addresses
Customer numbers
Dates of birth
Website search terms
When customers started using ASOS
Operational Impact: ASOS said it locked down the affected platforms, launched an investigation with internal and external specialists, and strengthened security controls. ASOS said its website and app remained safe to use.
Ransom Or Extortion: The group reportedly gave ASOS two weeks to make contact and demanded a ransom in exchange for deleting customer information. The attackers threatened to release the data. ASOS did not disclose whether it would pay.
Claim Status: confirmed