Asos Expands Data Breach Disclosure After Hackers Contact BBC

Online retailer Asos has issued a significant update to its customers regarding a major cyberattack, revealing that hackers possess far more personal information than initially disclosed. The warning follows an intervention by BBC News, which was contacted directly by the cybercriminals behind the breach.

While Asos had previously stated that only basic contact details might have been accessed, the company now acknowledges that detailed profiles of potentially millions of users are in the hands of criminals. The stolen data includes names, addresses, phone numbers, email addresses, and customer identification numbers. Additionally, records of customer search terms—such as “reclaimed vintage,” “glamorous wide fit,” and “Asos petite”—were compromised.

Security experts warn that the inclusion of search history significantly elevates the risk for consumers. This granular data allows scammers to craft highly personalized phishing emails and vishing (voice phishing) attacks that appear legitimate. Asos has advised customers to remain vigilant against unsolicited messages or calls claiming to be from the company, reiterating that it will never ask for passwords, security codes, or payment details through such channels.

The breach gained international attention on Tuesday when cybercriminals exploited Asos’s app system to push unauthorized pop-up notifications to potentially millions of users. Following the incident, Asos informed shareholders via the London Stock Exchange that an “unauthorised third party” had accessed basic personal information. However, on Wednesday evening, the hackers provided the BBC with a sample of the stolen data, demonstrating the comprehensive nature of the intrusion.

Asos confirmed in its customer communication that no bank details or passwords were accessed during the attack. The company declined to answer questions regarding the full scale of the breach. Customers are urged to monitor their accounts and report any suspicious activity.