Asos Hack: Criminals Hold Detailed Profiles of Millions, BBC Investigation Reveals

The scale of the cyber-attack on British online fashion retailer Asos is significantly greater than the company initially disclosed, with customers now being warned that hackers possess detailed personal profiles belonging to potentially millions of users. The retailer issued a fresh alert to its customer base after BBC News informed the company that cyber criminals had made direct contact with the broadcaster, claiming the intrusion went well beyond the limited scope of data Asos had previously acknowledged might have been compromised.

According to the information provided to the BBC, the stolen information includes full names, home addresses, telephone numbers, email addresses, unique customer reference numbers and dates of birth. All of this material is now in the possession of the perpetrators, a development that dramatically increases the risk of identity theft and sophisticated fraud for those affected. The retailer confirmed the wider breach in an email to customers, though it did not provide any response to questions from the BBC regarding the total number of individuals impacted.

Beyond the standard personal identifiers, the attackers also obtained records of what customers had searched for on the Asos website. Search queries such as "reclaimed vintage", "glamorous wide fit" and "Asos petite" are visible within the data sample reviewed by the BBC, offering an unusually intimate glimpse into the shopping habits and preferences of the site's user base. One woman who spoke to the BBC, identified as Harriet, said she found the situation deeply troubling, describing it as "very unsettling" that criminals now hold such specific details about her.

Harriet, who has been a customer of the online fashion giant since 2019, pointed out that even the length of her relationship with the brand is now known to the hackers. She expressed particular concern about the longer-term ramifications of the incident, noting that stolen data could be repurposed as a weapon in future attacks. In her view, the consequences of a breach of this nature can far outlast the immediate incident, creating ongoing vulnerabilities for those whose information has been exposed.

Armed with this combination of personal and behavioural data, fraudsters are in a far stronger position to craft convincing phishing emails or make persuasive phone calls. The risk to individual customers has therefore risen sharply, and users of the platform are being urged to remain vigilant for attempts at impersonation. Scammers who can quote a person's date of birth, home address or past purchase preferences are far more likely to be believed when they claim to represent a trusted brand.

In its communication to customers, Asos did confirm that detailed data profiles had been taken, but stressed that no banking information or account passwords were accessed during the incident. The company advised its users to treat any unexpected messages or calls purporting to come from Asos with suspicion. It reminded customers that it would never request passwords, security codes or payment details through unsolicited messages or telephone calls.

The high-profile hack first came to public attention earlier this week when the cyber criminals exploited Asos's own app notification system to push a pop-up message to potentially millions of users. The company subsequently informed shareholders through the London Stock Exchange that the notification had been sent by an "unauthorised third party" and that "basic personal information including name and contact details may have been accessed". A follow-up email to customers used similar language, downplaying the extent of what had actually been taken.

It was only on Wednesday evening that the criminals responsible made contact with the BBC, sharing a sample of the stolen data that exposed the true scope of the breach. The BBC chose to delay publication of this report in order to give Asos an opportunity to contact its customers directly before the details became public. This editorial decision reflects the sensitivity of a situation in which affected individuals needed to be warned before the broader world learned the full extent of what had happened.

Asos has stated that it is continuing to investigate the data breach and has pledged to contact customers directly in cases where it believes additional information, support or action may be required. The UK fashion retailer explained to its customers that the attackers managed to gain access to an Asos employee account by "impersonating a trusted contact to obtain log in credentials". Using that login for an unnamed service, the hackers were then able to download the customer data in bulk.

In the unauthorised pop-up notification sent to customers, the attackers claimed to have "compromised the Snowflake instance". Snowflake is a widely used data storage and analytics company whose customers have suffered breaches in the past as a result of unauthorised logins. The cyber criminals, who identify themselves as Xuanyewen, told the BBC they used a platform built natively on top of Snowflake, known as Simon AI, to obtain the data. Simon AI has been approached for comment, while Snowflake has previously maintained that its own platform was not breached.

Asos has told its customers that they are not being asked to take any action in response to the incident. However, cyber security professionals have cautioned users to change their passwords as a precautionary measure and to stay alert for any suspicious activity on their accounts. Trevor Dearing, Senior Director of Critical Infrastructure at the security firm Illumio, warned that scammers will likely exploit the publicity surrounding the attack to lend credibility to their approaches, referencing the breach and using personal details to appear genuine while manufacturing a sense of urgency.

Dearing suggested that fraudsters may threaten to lock a victim's account within 24 hours as a pressure tactic, and he stressed that because passwords were not stolen, customers should be highly suspicious of any unsolicited text or email urging them to change or share their credentials. Asos has sought to reassure its users by stating that its website and app remain safe to use, and that it recognises the trust customers place in the company with their information. The retailer said it takes that responsibility seriously and has already implemented additional security controls to further strengthen its defences.

The incident raises broader questions about how companies communicate with the public during cyber incidents, particularly when initial statements prove to be less comprehensive than the reality. The gap between Asos's initial description of "basic contact details" and the detailed profiles now confirmed to be in criminal hands illustrates the difficulty customers face in assessing their own exposure. For the millions of people who have shopped with Asos over the years, the episode serves as a reminder that the data trails left behind by everyday online activity can become valuable currency for those seeking to commit fraud.

As the investigation continues, affected customers are left to weigh the company's assurances against the practical advice of security experts. While Asos maintains that no financial information or passwords were compromised, the combination of names, addresses, dates of birth and shopping histories now circulating in criminal channels represents a significant resource for anyone intending to impersonate the retailer or its customers. The coming weeks will reveal whether the breach leads to a surge in targeted scams, and whether the retailer's additional security measures are enough to restore confidence among its user base.