Asos has updated its account of a data breach this week. The BBC reports that the criminals behind it contacted the broadcaster and said they had taken more than basic contact details, and the retailer then revised what it had told customers.
Key takeaways
- The BBC reports that Asos changed its public account of this week’s breach after the criminals behind it contacted the broadcaster.
- The attackers told the BBC that the stolen data went beyond basic contact information, which was how the breach had first been described.
- The full list of personal data affected, and how many customers are involved, had not been publicly confirmed at the time of writing.
- In data breaches, a company’s first statement often changes once its investigation shows what was actually accessed.
- Asos customers should watch for convincing phishing messages, check their account security and treat unexpected contact about orders or refunds with caution.
What is happening at Asos?
Asos, the online fashion retailer, has suffered a cyber attack in which customers’ personal information was taken. The BBC reports that the retailer first described the breach as limited to basic contact details. It has since issued an updated account. The update came after the people responsible for the attack contacted the BBC and said they had taken more than that.
Several details have not been published. There is no confirmed public list of which extra categories of personal data were taken. The number of affected customers is not known, and neither is the method the attackers used to get in. The exact timeline of the intrusion is also unclear. This article does not fill those gaps with guesses. It explains what a revised breach disclosure means and what customers can reasonably do while the facts are still coming out.
Why has the story moved on this week?
The new development is that the scope of the breach has been disputed. A retailer usually reveals a breach in a short statement that sets out what it believes was accessed. The BBC reports that the cyber criminals then contacted the broadcaster directly. They said they had taken more than the retailer had acknowledged. Asos then put out an update.
This pattern is common in modern cyber crime. Criminal groups often contact journalists to show what they have stolen. They may hope to put pressure on the victim company, make themselves look more credible, or push the company towards paying them. Reporters then have to work out how much of what the attackers say is true, because criminals have reasons to exaggerate. The BBC’s report suggests that in this case the claims were strong enough for the retailer to revise what it had said.
Why do first breach notices so often turn out to be incomplete?
Early statements are frequently revised, and there are structural reasons for this. Large online retailers spread customer data across many systems. Names and email addresses might be in one database, delivery addresses in another, and order histories or account settings somewhere else. When an intrusion is first spotted, security teams usually know only part of what the attacker touched. Working out the full extent can mean reviewing logs, rebuilding timelines and bringing in outside forensic specialists. That work can take days or weeks.
Companies are also under pressure to speak quickly. Under UK data protection law, organisations must usually report a personal data breach to the Information Commissioner’s Office within 72 hours of becoming aware of it, if the breach is likely to put people’s rights and freedoms at risk. Where the risk to individuals is high, they must tell the people affected without undue delay. These rules encourage early disclosure, but early disclosure means describing an incident before it is fully understood.
As a result, the first notice reflects what the company could confirm at that moment. A narrow first description does not necessarily mean anyone set out to mislead. It can, however, leave customers underestimating their exposure until a fuller account is published.
Who is affected, and how?
The people most directly affected are Asos customers whose records were in the compromised systems. Exactly who they are has not been publicly confirmed. The practical risk depends on what kind of data was taken.
Contact details alone, such as names, email addresses or phone numbers, are mainly useful for phishing. Fraudsters can send messages that look as if they come from the retailer, perhaps mentioning an order, a refund or a security problem, to trick recipients into handing over passwords or payment details. If more personal information has been taken, those messages can become more convincing, because they can mention real details a customer would expect only the retailer to know.
It has not been reported that payment card details or passwords were part of this breach, and readers should not assume they were. Anyone the retailer contacts directly should rely on what that notice says about their own account.
The company is affected too. A breach that turns out to be bigger than first stated can damage customer trust, draw closer attention from regulators and bring extra costs for investigation and support.
Where do informed people disagree?
Security professionals, journalists and privacy advocates take different views on several questions this kind of incident raises.
The first is how far to rely on what the attackers say. Some argue that reporting criminals’ statements gives them a platform and helps their extortion efforts. Others say that without outside pressure, companies may play down incidents, and that reporting checked claims is in the public interest. Most agree that what attackers say should be tested before it is published, though not everyone agrees on how much testing is enough.
The second is speed versus accuracy in disclosure. Consumer advocates generally prefer quick, cautious warnings, even if they need correcting later, so that people can protect themselves sooner. Some practitioners worry that repeated revisions confuse customers and wear down trust more than a single, later and fuller statement would. Regulators generally expect early notification with updates as more becomes known.
The third is how to describe the data involved. Phrases such as “basic contact details” can be technically accurate yet sound reassuring. Critics argue that even contact data does real harm because it fuels targeted fraud. Others say companies have to describe incidents precisely and cannot list every possible downstream risk.
What should Asos customers do now?
Customers do not need to wait for every detail to take sensible precautions.
- Treat unexpected emails, texts or calls that mention Asos, orders or refunds with caution, even if they contain accurate personal details.
- Do not click links in unsolicited messages. Go to the retailer’s website or app directly instead.
- Change the Asos account password if it has been used anywhere else, and use a unique password for each service.
- Turn on any extra sign-in protection the retailer or the linked email account offers.
- Keep an eye on bank and card statements for unfamiliar activity, as general good practice.
- Read any official breach notice carefully and follow its specific advice.
Customers who think they have been targeted by fraud can report it to their bank. In the UK they can also use the national fraud reporting channels. People who are unhappy with how their data has been handled can complain to the company first and then to the Information Commissioner’s Office.
What should readers watch for next?
Several points remain open. Asos may publish a fuller description of the data involved, and possibly an estimate of how many customers were affected. Whether the Information Commissioner’s Office takes any formal interest is not known. Nor is it known whether the attackers will release or sell the data, which some criminal groups do when their demands are not met. Readers should also look for any confirmation of how the attackers got in, because that affects whether similar weaknesses could exist elsewhere. Until official updates appear, the most reliable guide is direct communication from the retailer, read alongside careful reporting from established news organisations.
Frequently asked questions
What happened in the Asos data breach?
Asos, the online fashion retailer, suffered a cyber attack in which customers’ personal information was taken. The BBC reports that the retailer first described the stolen data as basic contact details. It later issued an update after the criminals responsible contacted the broadcaster and said they had taken more. The full list of data involved and the number of people affected had not been publicly confirmed.
Were Asos customers’ card details stolen?
No public reporting has said that payment card details were taken in this breach, and readers should not assume they were. The only confirmed point is that the breach went beyond what the retailer first described. Customers should rely on any direct notice from Asos about their own account and check their bank statements as a matter of routine.
Why did Asos change its statement about the breach?
The BBC reports that the retailer issued an update after the cyber criminals contacted the broadcaster and said they had taken more than basic contact details. More generally, companies often revise breach statements as investigations show what attackers actually accessed, because early disclosures are based on incomplete information gathered under time pressure.
How do I know if my Asos account was affected?
Companies usually contact affected customers directly when a breach creates a high risk to them, and that notice should explain what was involved. Until then, Asos customers should assume they may be targeted by phishing. They should change any reused passwords and be wary of unexpected messages that mention orders, refunds or account problems.
What should I do if I get a suspicious email claiming to be from Asos?
Do not click any links or open any attachments, and do not reply with personal or payment details. Go to the retailer’s official website or app directly to check your account. Report suspicious messages to your email provider and, in the UK, to the national fraud reporting channels. Contact your bank immediately if you think you have shared financial details.
Do UK companies have to report data breaches?
Yes. Under UK data protection law, organisations must usually report a personal data breach to the Information Commissioner’s Office within 72 hours of becoming aware of it, if it is likely to put people’s rights and freedoms at risk. Where the risk to individuals is high, they must also tell the affected people without undue delay.
Sources and further reading
- BBC News technology coverage, which reported the attackers’ contact and the retailer’s updated statement
- Information Commissioner’s Office, guidance on personal data breach reporting under UK data protection law
- National Cyber Security Centre, public advice on recognising and reporting phishing messages
- Asos customer communications and official statements about the incident
Surfaced from the rss:bbc_tech signal “online retailer data breach”. AI-assisted draft, editorially reviewed.
