Asos hackers took more personal details than first revealed, BBC finds

The BBC reports that Asos issued the update after BBC News told the retailer it had been contacted by cyber criminals who said this week's breach went beyond the "basic contact details"[1] that Asos had first described.According to the BBC, names, addresses, phone numbers, emails, customer numbers and dates of birth are now in the hands of criminals.[1] The BBC says that terms like "reclaimed vintage", "glamorous wide fit" and "Asos petite" are visible in the data.[1]The BBC reports that in its email to customers, Asos confirmed data profiles were taken but said no bank details or passwords were accessed.[2] According to the BBC, Asos told customers that hackers "gained access to an Asos employee account by impersonating a trusted contact to obtain log in credentials".[2]The BBC says the cyber criminals, calling themselves Xuanyewen, claimed to the BBC they used a platform which is built natively on top of Snowflake - called Simon AI[1]. Malwarebytes reports that Snowflake said it had found no compromise of its platform.[3]One victim told the BBC it was "very unsettling" that the hackers now know these things about her.[1]Trevor Dearing of Illumio told the BBC: "Expect scammers to mention the attack, use your personal details to seem genuine, and create urgency"[1].According to the BBC, Asos said it is still investigating the data breach and it would "contact customers directly where we believe additional information, support or action may be required".[1]