Asos Breach Worse Than Admitted: Hackers Hold Full Customer Profiles, BBC Investigation Reveals

Online fashion retailer Asos has privately acknowledged to its customers that cyber criminals behind this week's high-profile attack are holding far more sensitive information than the company initially disclosed, following a BBC News investigation that uncovered the true scope of the breach.

In an email sent to shoppers, the UK-based fashion giant confirmed that detailed personal profiles belonging to potentially millions of users are now in the hands of attackers — a significant escalation from the "basic contact details" the firm had previously said might have been compromised.

According to the company's updated warning, the stolen data includes names, home addresses, telephone numbers, email addresses, customer account numbers and dates of birth. The criminals also appear to have obtained records of what individual shoppers searched for on the Asos website and app, with terms such as "reclaimed vintage," "glamorous wide fit" and "Asos petite" visible in the sample of data reviewed by the BBC.

The retailer issued the revised notification only after BBC News informed it that cyber criminals had made direct contact with the broadcaster, supplying evidence that the intrusion extended well beyond what Asos had told shareholders and customers earlier in the week.

One customer, Harriet, who has been shopping with Asos since 2019 — a detail the attackers now also possess — described her reaction to the news. She said what concerned her most was the prospect that the stolen information could be weaponised in future attacks, meaning the consequences of the breach might stretch far beyond the immediate incident. She called the situation "very unsettling."

Security analysts warn that the combination of data now in criminal hands is particularly dangerous. With names, addresses, dates of birth and phone numbers all available, fraudsters are well equipped to craft convincing phishing emails or make telephone calls that appear entirely legitimate. Because the attackers can reference genuine account details, shopping histories and search preferences, targets may find it far harder to identify a scam.

Asos sought to reassure customers that no banking information or passwords were taken. In its message, the company urged shoppers to treat any unexpected communication claiming to come from Asos with suspicion, stressing that it would never request passwords, security codes or payment details through an unsolicited message or phone call. The firm added that customers were not being asked to take any action, and that its website and app remained safe to use.

The company declined to answer questions from the BBC about the total number of people affected or the full scale of the data loss, leaving customers without a clear picture of how many individuals should be on alert.

The incident first came to public attention on Tuesday, when the hackers exploited Asos's own app notification system to push a pop-up message to what may have been millions of users. The message, which simply read "ASOS HACKED," was seen by customers and quickly generated global media coverage.

Later that same day, Asos informed shareholders through the London Stock Exchange that the notification had been sent by an "unauthorised third party" and stated that "basic personal information including name and contact details may have been accessed." A follow-up email to customers used similar language, playing down the severity of the incident.

It was only on Wednesday evening that the perpetrators contacted the BBC directly, sharing a sample of the exfiltrated data that demonstrated the true extent of the compromise. The BBC chose to delay publication of its findings to give Asos an opportunity to reach its customers first.

In its explanation to shoppers, Asos said the attackers had gained entry by impersonating a trusted contact in order to obtain login credentials for an Asos employee account. Using that access to an unnamed service, the criminals were able to download the customer data in bulk.

In the pop-up notification itself, the hackers claimed to have "compromised the Snowflake instance." Snowflake is a widely used cloud-based data storage and analytics provider whose customers have suffered breaches in the past as a result of unauthorised logins. The criminal group, which calls itself Xuanyewen, told the BBC it used a platform built natively on top of Snowflake, known as Simon AI, to reach the data. Snowflake has previously maintained that its own platform was not breached, and Simon AI has been approached for comment.

Trevor Dearing, Senior Director of Critical Infrastructure at the cybersecurity firm Illumio, offered advice to concerned customers. He noted that because passwords were not stolen, users should be highly suspicious of any unsolicited text or email urging them to change or share their credentials. He predicted that scammers would reference the attack by name, deploy stolen personal details to appear credible, and manufacture a sense of urgency — for example, by threatening to lock an account within 24 hours. Other security experts have echoed the recommendation that users change their passwords as a precaution and monitor their accounts for unusual activity.

Asos insisted that it takes its responsibility to protect customer information seriously, saying it had already implemented additional measures to strengthen its security controls. The company said it is continuing to investigate the breach and would contact customers individually wherever it believes further information, support or action is required.

The episode raises difficult questions about how transparent companies should be when they fall victim to cyber attacks, particularly in the crucial early hours when customers need clear guidance. Asos's initial statements suggested a limited exposure, yet the evidence gathered by the BBC points to a much broader loss of personal data — a discrepancy that may erode trust among the retailer's customer base.

For affected shoppers, the practical fallout is likely to unfold over the coming weeks and months. Criminals holding verified personal profiles can attempt credential-stuffing attacks against other services, open fraudulent accounts, or mount targeted social engineering campaigns. Consumers are being advised to remain vigilant, verify the source of any communication before acting on it, and report suspicious messages to the company and to the relevant authorities.