Asos warns customers that hackers accessed detailed user profiles

Asos has warned customers that cyber criminals obtained detailed profiles of potentially millions of people who use its online store. The retailer updated its account after the BBC told it that hackers had contacted the broadcaster and claimed the breach went beyond the “basic contact details” Asos had previously said might have been accessed.

The stolen data includes names, addresses, phone numbers, email addresses and customer numbers, as well as searches made on the website. The sample shared with the BBC showed searches including “reclaimed vintage”, “glamorous wide fit” and “Asos petite”. The company did not answer questions about how many customers were affected.

Asos said no bank details or passwords were accessed. It warned customers about possible impersonation scams and advised them to be cautious of unexpected messages or calls claiming to come from the retailer. Asos said it would never request passwords, security codes or payment details through an unsolicited message or call.

The incident became public on Tuesday, when hackers used Asos’s app system to send a pop-up notification to potentially millions of users. The company told shareholders via the London Stock Exchange that an “unauthorised third party” sent it and that “basic personal information including name and contact details may have been accessed”. On Wednesday evening, the hackers contacted the BBC and shared a sample of the data, prompting Asos’s updated warning.