Hackers breach ASOS systems and access customer search data

Hackers accessed customer information at online retailer ASOS after tricking an employee into revealing login credentials. Malwarebytes Labs, The Record, and Claims Journal all reported that the unauthorized access allowed attackers to send a rogue push notification directly through the ASOS mobile application. Customers received the push notification earlier in the week informing them that the company had suffered a cyberattack. [1][2][6]

ASOS initially stated that attackers only obtained basic personal information. However, reporting by the BBC and Malwarebytes Labs revealed that the compromised data includes customer shopping searches alongside names and contact details. ASOS confirmed that payment card information and account passwords were not accessed during the incident. [1][4][5]

According to BankInfoSecurity, the hackers claimed they breached a Snowflake-connected system called Simon AI to execute the intrusion. The incident highlights ongoing risks regarding social engineering attacks against corporate employees to obtain administrative or service credentials. [2][3][6]

Malwarebytes Labs warned that the exposure of specific shopping search histories alongside personal contact details enables attackers to craft highly targeted phishing messages. Security teams advise ASOS customers to remain vigilant against suspicious emails or communications impersonating the retailer. [1][5]