When hackers recently hijacked the e-retailer's official app and sent extortion messages to users, Asos initially stated that only basic contact information may have been leaked. Now it turns out that the intrusion is significantly larger than that, reports BBC.
The news channel has received samples of the stolen data directly from the hacking group, known as Xuanyewen. The material proves that they have obtained detailed customer profiles potentially affecting millions of users. The stolen information includes names, addresses, phone numbers, email addresses, customer numbers, dates of birth, and users' internal search history on the Asos website.
Warns of Targeted Attacks
According to Asos, however, neither bank details nor passwords have been compromised in the intrusion. The attack occurred when hackers tricked their way into login credentials for an employee account via phishing, posing as a trusted contact. The hackers themselves claim that they then accessed the data via the Simon AI data platform, which is built on top of Snowflake.
Customers are now urged to be extra vigilant. Due to the detailed information leaked, it is warned that users may be exposed to targeted phishing attacks and advanced fraudulent messages in the future.