Asos data breach worse than first revealed, BBC finds

Customer numbers were also potentially accessed

The online retailer initially told customers that only “basic contact details” had been exposed. 

However, the company later issued a further warning after BBC News was informed that the stolen data went beyond that.

Names, home addresses, telephone numbers, email addresses and customer numbers are among the information believed to have been accessed. 

The breach may also have exposed searches carried out by customers while using the ASOS website.

In practical terms, that could include searches for phrases such as “reclaimed vintage”, “glamorous wide fit” and “Asos petite”.

Experts are warning ASOS customers to be extra careful

Although no passwords are believed to have been taken, cyber security specialists have warned that the stolen information could still be valuable to fraudsters. 

Combining someone's contact details with information about what they have been looking for on ASOS could give scammers enough context to make fake communications seem genuine.

Trevor Dearing, senior director of critical infrastructure at Illumio, said customers should be particularly careful with unexpected messages following the breach.

He warned that criminals could refer to the incident itself and use real details about victims in an attempt to gain their trust. They could then create a false sense of urgency, such as claiming an account will be closed within 24 hours.

“Passwords have not been stolen, so be highly suspicious of any unsolicited text or email asking you to change or share yours,” Dearing said.

Shoppers are being warned to watch out for unusual contact

ASOS has told customers that they do not need to take any specific action as a result of the breach. 

Experts have nevertheless recommended changing passwords as a precaution and being alert to unusual emails, texts or phone calls.

The retailer has also reassured shoppers that its website and app remain safe to use, while saying it has introduced additional security measures.

“We know our customers trust us with their information,” ASOS said. “We take that responsibility seriously and have already taken additional steps to further strengthen security controls.”