ASOS Data Breach: Search Histories Fuel Targeted Phishing Fears

What happened

Asos, the UK online fashion retailer, has confirmed that attackers accessed personal data belonging to millions of its customers. The theft included names, delivery and email addresses, and phone numbers, along with something less common in breach disclosures: customers' recent search histories 1. Logged queries such as "glamorous wide fit" and "Asos petite" were part of the stolen data 1.

The incident came to light in an unusual way. On the morning of October 6, app users received an unsolicited push notification titled "ASOS HACKED" that linked to a Telegram channel. It was sent through the retailer's own official app rather than by email 31. The message was addressed to Asos's data protection officer and IT department. It claimed the hackers had "fully compromised" company data hosted on Snowflake, a cloud data-analytics platform, and warned: "Engage with us, or we will leak it" 4. Many recipients posted screenshots on social media 4.

After what it called a "detailed, 48-hour investigation," Asos confirmed the breach to customers 1. In a London Stock Exchange filing, it said hackers had broken into a third-party platform that holds data the company uses to communicate with customers 4. In its account to customers, the attackers got in by taking over an Asos employee account after impersonating a trusted contact 12. The retailer says payment card details and passwords were not accessed 12.

More than the first disclosure suggested

Asos's first statements focused on "basic" contact information. Reporting by the BBC indicated the haul was broader and included notes attached to customer profiles, such as website search queries 42. The data also appears to show how long people have been customers. One shopper, Harriet, told the BBC that the hackers now know she has used Asos since 2019 2. She said she was concerned that stolen data could be used in later attacks, so the damage could extend "well beyond the initial incident" 2.

Asos did not answer questions about the scale of the breach. It said its investigation is continuing and that it will contact customers directly where further support or action is needed 2.

Why search histories matter

Payment details were not taken, but security experts quoted by the Guardian say the mix of data could help criminals write "highly convincing" phishing scams 1. A scam message that only knows your name and email address is generic. One that also knows your address, your phone number, how long you have shopped with a retailer and the specific styles you searched for last week can be tailored to you. It could arrive as a fake "back in stock" alert for an item you looked at, or a call about a delivery to your real address.

Asos's own warning reflects this risk. It told customers to be wary of unexpected messages or calls claiming to come from the company and stressed that it will never ask for passwords, security codes or payment details through unsolicited contact 2. Because the attackers have already shown they could send messages through the official Asos app, customers have more reason than usual to treat even familiar-looking communications with caution.

A dispute over whose systems failed

The accounts diverge on one main point: where the breach happened. The group behind the notification, which calls itself the Xuanye Group, says it compromised Asos's Snowflake instance. Snowflake says its own investigation "found no compromise" of its platform 3. Some observers have drawn comparisons to a 2024 incident involving Snowflake that affected around 165 organisations, which keeps attention on the cloud provider 3.

These positions are not necessarily contradictory. Asos describes an employee account taken over through impersonation 1. If that is accurate, the attackers could have reached data stored on a third-party platform without that platform itself being breached. In that reading, the weak point was a human being deceived by social engineering, not a software flaw in the cloud service. Until a fuller forensic account is published, this remains an inference rather than an established fact.

The pressure on Asos is significant. Its shares have reportedly fallen about 13%, and the attackers have set a two-week extortion deadline 3.

The takeaway

The Asos case shows that low-sensitivity data can still be valuable to attackers. Browsing behaviour and account history can make phishing far more convincing, and a breach notice that says "no payment data was taken" can understate the real risk to customers. For retailers, the lesson is that protecting the people and accounts with access to customer data matters as much as securing the cloud services that store it. For customers, the practical advice is to be suspicious of any unexpected message that seems to know a lot about them.