Asos hackers took more personal details than first revealed, BBC finds

The BBC reports that names, addresses, phone numbers, emails, customer numbers and dates of birth are now in the hands of criminals[1]. According to the BBC, the criminals also have access to the searches customers have made on the website[1].The BBC says that on Tuesday Asos told the London Stock Exchange that "basic personal information including name and contact details may have been accessed."[1] The broadcaster reports that on Wednesday evening the cyber criminals responsible contacted the BBC sharing a sample of the stolen data[1], and that it held off publishing this article to allow Asos to contact its customers first.[1]According to the BBC, Asos told customers that hackers got into an employee account by "impersonating a trusted contact to obtain log in credentials"[1]. The BBC reports that Asos confirmed data profiles were taken but said no bank details or passwords were accessed.[2]The BBC reports that the hackers, calling themselves Xuanyewen[1], claimed they got in through Simon AI, a platform built on Snowflake. Malwarebytes reports that Snowflake said it had found no compromise of its platform.[3]Speaking to the BBC, Trevor Dearing of Illumio warned that scammers may "mention the attack, use your personal details to seem genuine, and create urgency"[1].According to the BBC, Asos said "We take that responsibility seriously and have already taken additional steps to further strengthen security controls"[4].