British online fashion retailer ASOS has confirmed that an unauthorised party accessed some customer information after impersonating a trusted contact to obtain the login credentials of an employee.
The company said the credentials were then used to gain access to information held on certain third-party platforms used by ASOS. The affected platforms were quickly secured, and the retailer said its website and mobile app remained safe to use throughout the incident.
ASOS said the information accessed included customers’ names and contact details, while some non-personal account-related information was also exposed. Further reports indicate that customers’ recent search histories may have been among the information accessed.
The breach followed an unauthorised push notification sent to some customers on October 6 carrying a message that the company had been hacked and directing users to an external Telegram channel.
ASOS said its investigation found no evidence that payment card details or account passwords were accessed. The company has locked down the affected platforms and is working with cybersecurity specialists, law enforcement and regulatory authorities to investigate the incident.
The retailer has advised customers to be cautious about unexpected calls or messages claiming to come from ASOS, particularly requests for passwords, security codes or payment information.
The incident adds to growing cybersecurity concerns facing major UK businesses and could put additional pressure on ASOS as it works to rebuild customer confidence and strengthen its business following several difficult years.
Leave a comment