Online fashion retailer Asos has revealed that hackers accessed the personal data of millions of customers, including names, addresses, phone numbers and recent search histories, but says card details and passwords were not compromised.
Online fashion retailer Asos has disclosed that hackers gained access to the personal data of millions of its customers, according to the Guardian. The accessed information included customers’ names, addresses and phone numbers, as well as their recent search histories on the platform.
Among the data accessed were specific search terms typed in by customers, such as “glamorous wide fit” and “Asos petite”, the Guardian reported. The retailer said that card details and passwords were not among the information compromised in the breach.
The cyber-attack emerged on Tuesday after app users received a notification titled “Asos hacked”, which contained a link to the Telegram messaging service, according to the Guardian.
Security experts told the Guardian that the breadth of the data accessed could help attackers devise “highly convincing” phishing scams. The combination of personal contact details with knowledge of what customers have been searching for could make fraudulent messages appear more credible.
Asos confirmed the incident affected millions of users. The retailer has said that while contact and personal details were exposed, the financial information customers would typically be most concerned about remained protected.
Why it matters
Data breaches at major online retailers put millions of consumers at risk of targeted scams, even when financial details are not directly stolen. Because the exposed Asos data combines personal contact information with shopping search histories, experts warn attackers could craft unusually convincing phishing attempts that trick customers into handing over more sensitive information.