Asos hackers took more personal details than first revealed, BBC finds

The BBC reports that "names, addresses, phone numbers, emails, customer numbers and dates of birth are now in the hands of criminals."[1]The broadcaster says the criminals can also see customers' searches on the website, with terms like "reclaimed vintage" and "Asos petite" visible in the data.[1]According to the BBC, the hack first made global headlines on Tuesday, when criminals used Asos's own app system to send a pop-up notification to potentially millions of people.[2]NewsCord reports that the notification sent recipients to a Telegram channel run by the Xuanye Group.[3]The BBC reports that Asos told shareholders the pop-up came from an "unauthorised third party" and that "basic personal information including name and contact details may have been accessed."[1]The BBC says the hackers contacted it on Wednesday evening with a sample of the stolen data, and that it waited to publish so Asos could contact customers first.[1]According to the BBC, Asos told customers the hackers got into an employee's account by "impersonating a trusted contact to obtain log in credentials".[1]The BBC reports that Asos said no bank details or passwords were accessed.[2]The BBC says one victim called it "very unsettling" that the hackers now know these things about her.[1]NewsCord reports that Trevor Dearing of Illumio warned: "Expect scammers to mention the attack, use your personal details to seem genuine, and create urgency"[3].Asos told the BBC it has "already taken additional steps to further strengthen security controls".[1]