Asos has issued a warning to customers after revealing the full extent of a data breach earlier this week. The retailer says hackers are in possession of detailed profiles of potentially millions of its users.
The news emerged after the hackers reportedly contacted the BBC claiming the data breach went beyond the "basic contact details" that Asos previously said may have been accessed. The cyber criminals claim they have names, addresses, phone numbers, emails, and customer numbers.
Customer searches also exposed
The BBC reports that customer searches are also in the hands of cyber criminals. Terms such as "reclaimed vintage", "glamorous wide fit", and "Asos petite" are included in the data. This means the criminals may be able to use the data to create phishing emails or calls to target customers.
It means the risk to individuals is higher than previously thought. Asos is now warning customers to watch out for potential impersonation scams. However, it says no bank details or passwords were accessed by the cyber attackers.
In an email to customers, it said: "Please remain cautious of unexpected messages or calls claiming to be from Asos. We will never ask you to share passwords, security codes or payment details through an unsolicited message or call."
Notification sent by 'unauthorised third party'
Asos is yet to comment on the scale of the data breach. But the hack made global news on Tuesday when the hackers issued a notification to those with the Asos app.
The firm later told shareholders that the message was issued by an "unauthorised third party" and claimed that "basic personal information" had been accessed. The BBC, however, says the cyber criminals contacted the broadcaster on Wednesday showing the extent of the data they had accessed.
Asos is said to be investigating how the hack happened. It is believed that the hackers gained access to an "employee account by impersonating a trusted contact to obtain log in credentials". It is thought this was then used to download customer data.
A notification sent to customers then said the attackers had "fully compromised the Snowflake instance". It went on to demand the company "engage" with the hackers or they will leak the information. Snowflake is a popular data storage and analysis company. The BBC says it has previously said its platform had not been breached.
What should Asos customers do?
Asos says customers don't need to take action at the moment. Its email to customers says it is still investigating and will contact people should they find "additional information, support or action may be required".
It added: "We know our customers trust us with their information. We take that responsibility seriously and we have already taken additional steps to strengthen our security controls."
