The ASOS Breach Has Grown: Customer Profiles Were Downloaded
The ASOS Breach Has Grown: Customer Profiles Were Downloaded
New details about the ASOS cyber incident reveal stolen customer profiles and compromised employee credentials. What happened, what customers should know and what businesses can learn.
The ASOS data breach now involves downloaded customer profiles containing names, contact details, dates of birth and website searches. ASOS says an attacker obtained an employee's login credentials by impersonating a trusted contact. Although passwords and payment details reportedly weren't accessed, the stolen information could be used in convincing phishing and impersonation attempts.
Last week, we wrote about the unauthorised ASOS app notification and the claim that attackers had compromised a Snowflake environment. At that point, the notification itself was real, but most of the story behind it was largely still a mystery, by all accounts.
ASOS’s first public account said that names and contact details may have been accessed. It didn’t believe payment-card information or account passwords were involved. The company’s customer notice also said the activity involved third-party platforms used to communicate with customers.
By Thursday afternoon, that description had widened. ASOS told customers that somebody had impersonated a trusted contact, obtained an employee’s login credentials and used the account to download customer data from an unnamed service.
The BBC was shown a sample of the stolen data, reporting that the records contained names, postal addresses, phone numbers, email addresses, customer numbers, dates of birth and searches made on the ASOS website. ASOS still says bank details and account passwords weren’t taken, and at present, hasn’t confirmed how many customers are affected.
What data was taken in the ASOS breach?
The customer profiles reported by the BBC contained:
- Customer names
- Postal addresses
- Phone numbers and email addresses
- ASOS customer numbers
- Dates of birth
- Search terms entered on the ASOS website
Those fields, when put together, provide a scammer with useful context to set up a fairly convincing next steps plan, so you should be on high alert if you suspect your information has been compromised.
All it takes is an email that can refer to an ASOS account, quote the correct postcode and mention the kind of product somebody searched for. All of a sudden, a fake refund or delivery problem suddenly looks rather plausible, especially when it lands during a busy working day.
The National Cyber Security Centre has advised ASOS customers to assume they may be affected, even if they didn’t receive the unauthorised notification, while also echoing that suspicious messages can arrive some time after a breach.
No password doesn’t mean no risk
The absence of passwords limits one obvious route into an account, but the rest of the profile can still help somebody pretend to be ASOS, a courier or a payment provider.
The follow-on attempt might be a “refund failed” email next week. It could be a call about an order months from now, when the breach is no longer fresh in anyone’s mind. The levels of information at their fingertips give any malicious outsider more than enough detail to ensure they sound legitimate.
For what it’s worth, ASOS says it won’t ask for passwords, security codes or payment details through an unsolicited message or call, so anyone contacted unexpectedly should close the message or end the call, then open the official site or app themselves.
The entry point was an employee account
According to ASOS’s update, the attacker impersonated a trusted contact and obtained an employee’s login credentials. Reports state that the account was then used to reach an unnamed service and download the profiles.
The attackers told the BBC that the service was Simon AI, which is built on Snowflake. Snowflake has said its own platform wasn’t compromised, and ASOS hasn’t publicly confirmed that technical account.
That does then open the door to a familiar access question, tucked away underneath the vendor names: could one employee sign-in open a customer platform and allow a large export without anybody noticing?
Many sales, marketing and support systems that are likely tied to your business hold detailed records, yet they don’t always receive the same scrutiny as Microsoft 365 or the corporate network. It’s food for thought, if nothing else.
The controls UK businesses should review
Cloud customer platforms belong in the security estate. That sounds obvious, although ownership is often split between an operational team and IT, with any gaps showing up when somebody needs to revoke access quickly, or work out who downloaded a file.
Check who can export customer data
List the people and service accounts with permission to export records, and remove access that belonged to an old role or abandoned project. Administrators should use phishing-resistant multi-factor authentication where the service supports it, with a separate check before access is recovered or reset.
Staff who hold powerful accounts also need a reliable way to verify an unusual request from a supplier or colleague - remember: a familiar display name in email or chat isn’t enough.
Make unusual activity visible
A bulk download or a newly created administrator should always generate an alert. The same applies when a privileged account signs in from an unexpected location. Each alert needs an owner who can check it promptly; sending everything to an unattended mailbox achieves very little.
Try retrieving the evidence before an incident forces the issue. Your team should be able to identify the account behind an export and revoke its active sessions. Check how long the logs are retained, too, because a 30-day window can disappear while an investigation is still finding its feet.
Keep less data where you can
Customer platforms tend to tick away in the background, quietly accumulating information. A useful field is copied into an analytics tool, retained for a future campaign, and then, a few years go by, and it’s just still sitting there. Few businesses set out to build a sprawling customer profile; it kind of just… happens? One integration after another, after another.
Review the fields sent into each platform and the retention period attached to them, and delete/anonymise records that no longer serve a clear purpose. Data minimisation won’t stop a compromised login, though it can leave far less behind that login.
Include suppliers in the incident plan
For every critical cloud service, record the internal owner and the supplier’s emergency support route. The contract should say what logging is available and how quickly the supplier must notify you. It should also be clear whether the supplier will help preserve evidence during an investigation.
A UK organisation must assess the risk that a personal data breach creates for individuals. The ICO says a notifiable breach should be reported without undue delay and, where feasible, within 72 hours. An initial report can be updated as the investigation develops, but every breach still needs an internal record, including those that don’t meet the reporting threshold.
Write updates that can survive new evidence
An early statement won’t contain the whole investigation, and any situation similar to this will evolve by the hour. To start with, say which facts are confirmed and be specific about the information still under review. When the scope inevitably changes, explain what has been learned since the previous update instead of quietly replacing the old wording.
The ASOS incident adds another complication: the attacker used the customer notification channel. It’s unlikely many businesses have the same capacity as an e-commerce giant with ASOS-level infrastructure, but if you have similar functionality, you should know who can send a message to the full customer base and how that access can be suspended while legitimate updates continue elsewhere.
What should ASOS customers do now?
ASOS says customers aren’t currently being asked to take action and that its website and app are safe to use - its customer notice is also being updated as the investigation continues.
The exposed profile data still calls for a little more suspicion than usual, though. Make sure you treat unexpected emails, texts and calls about ASOS orders, refunds, returns, deliveries or account security with caution.
Use official channels
Open the official ASOS website or app yourself instead of using a link in a message.
Protect your credentials
Never share a password, one-time security code or payment information with an unexpected caller or message sender.
Check password reuse
Use a unique password for ASOS, and if the same password is used anywhere else, change it there too.
Review account activity
Review account and bank activity and report anything unfamiliar through the organisation’s official contact route.
A data breach can grow after the first statement
On the 6th of October 2026, the public facts amounted to an unauthorised notification and possible access to contact details. Two days later, ASOS had described an employee account compromise and confirmed that customer profiles were downloaded, and BBC reporting showed that the records also included customer numbers, dates of birth and search history.
That’s intrinsically how many incident investigations develop. The early account changes as logs are reviewed and stolen material appears, and a company needs enough visibility to correct the record quickly without filling the first update with guesses.
For a smaller business, the useful exercise is straightforward: pick the external platform holding the richest customer data and ask who can export from it. Then check whether a large download would be noticed before the file had left the building - you may be surprised that the answer is often less certain than people expect.
ASOS data breach FAQs
What information was stolen in the ASOS data breach?
The latest reporting says the profiles contain customer names and postal addresses, along with phone numbers, email addresses, customer numbers, dates of birth and website searches. ASOS says bank details and account passwords weren’t accessed. The number of affected customers hasn’t been confirmed.
How did the ASOS breach happen?
ASOS told customers that somebody impersonated a trusted contact and obtained an employee’s login credentials. The account was used to reach an unnamed service and download customer data. Attackers have linked the service to Snowflake, but Snowflake says its platform wasn’t compromised. ASOS hasn’t confirmed the full technical chain.
Was the ASOS website or app hacked?
An unauthorised message was sent through ASOS’s app notification channel, and data was downloaded from a third-party service accessed through an employee account. ASOS says its website and app remain safe to use. Receiving the notification doesn’t show that an individual phone was compromised.
Should ASOS customers change their password?
ASOS says account passwords weren’t accessed and it isn’t currently asking customers to change them. Customers should still make sure their ASOS password is unique. Any password reused on another account should be changed, regardless of this incident.
What can businesses learn from the ASOS cyber incident?
Businesses should include third-party customer platforms in their normal security reviews. Start with the accounts that can export records and the alerts generated by a large download. Supplier support routes and UK GDPR breach procedures should already be documented before an incident begins.
Know where your customer data is exposed
From privileged access and monitoring to supplier security and incident response, Fifosys helps businesses identify gaps and strengthen the controls around critical systems and information.
Talk to our team
Discuss your existing security arrangements, customer data platforms and the practical steps needed to reduce exposure.
Security Framework
Understand the measures that help businesses protect identities, systems, applications and sensitive data.