ASOS confirms data breach following social engineering attack on employee credentials

UK online fashion retailer ASOS has confirmed a data breach following a cyber security incident on October 6. In an email sent to customers on October 8, the company stated that personal and customer account data was accessed by an unauthorized third party, according to InfoSecurity Magazine. InfoSecurity Magazine and Global Banking and Finance Review both report that the breach involved unauthorized access to personal customer information. [4][5]

InfoSecurity Magazine and SecNews.gr report that the breach occurred after an attacker gained access to an employee account by social engineering, specifically by impersonating a trusted contact to obtain log in credentials. InfoSecurity Magazine added that the compromised credentials were used to access third-party platforms used by the company. Attackers claimed that the compromise involved the marketing platform Simon AI. [4][8]

According to shattered.io, no passwords were hit during the breach. InfoSecurity Magazine further reported that payment information was not compromised during the incident and that ASOS business operations were not affected. [1][4]

NewsCord reports that the exposed customer information included names, addresses, phone numbers, email addresses, and customer numbers. Cybersecurity Insiders and GBHackers News reported that attackers have sent threatening messages directly to ASOS customers following the data leak. [2][9][11]