ASOS links data breach to social engineering attack, credential theft

The breach at ASOS resulted from a social engineering attack in which an attacker impersonated a trusted contact to steal an employee's login credentials. These credentials were then used to access information on third-party platforms associated with ASOS. The exposed data includes full names, contact details, and some non-personal account-related information. Payment card data and account passwords were not compromised. ASOS responded by locking down affected platforms and involving external experts and authorities in the investigation. The company communicated to customers that their website and app remain secure and advised vigilance against phishing attempts.

The breach exposed some customers' basic personal information and contact details but did not compromise payment card information or account passwords. This limits the potential for direct financial fraud but may increase the risk of targeted phishing or social engineering attacks against affected customers. ASOS's core services and payment systems were not impacted, and no evidence suggests further compromise beyond the accessed third-party platforms.

ASOS has locked down the affected third-party platforms and is conducting an ongoing investigation with external experts and law enforcement. The company has implemented additional security measures to prevent similar incidents. Customers are advised that no action is required on their accounts but should remain cautious of unexpected messages or calls claiming to be from ASOS. ASOS emphasizes that it will never request passwords, security codes, or payment details through unsolicited communications.