Asos widens its breach disclosure after hackers share a data sample with the BBC

The first statement was written to the attackers' timetable. Their pop-up had already gone out ^[11] when Asos told the London Stock Exchange that an "unauthorised third party" was responsible and that "basic personal information including name and contact details may have been accessed" ^[12]. Its customer email used similar wording ^[12].

The trade-off in that wording was speed against completeness. A skeptic would say Asos was accurate, since "may have been accessed" claims no more than the company knew that day ^[12]. The difficulty is the word "basic". A shopper who read it had little reason to expect a stranger to know their address, their customer number, or that they had searched the site for "glamorous wide fit" ^[5]. The attackers held all of that ^[5].

We do not know yet whether Asos had found the wider loss before the BBC told it of the attackers' approach ^[4]. The group sent the BBC its sample on Wednesday evening ^[13]. The BBC then held its article so Asos could write to customers first ^[14]. Asos did not respond to the BBC's questions about the scale of the breach ^[10].

The stolen profiles suit the same technique that got the attackers in. Asos told customers the hackers "gained access to an Asos employee account by impersonating a trusted contact to obtain log in credentials" ^[16]. The BBC reported that, with the profiles, scammers may be able to craft potent phishing emails or phone calls ^[6]. Asos told customers, "Please remain cautious of unexpected messages or calls claiming to be from Asos" ^[8]. It added: "We will never ask you to share passwords, security codes or payment details through an unsolicited message or call" ^[9].

The route to the data is disputed. Asos says the hackers used that login to an unnamed service to download the customer data ^[16]. Their pop-up claimed they had "compromised the Snowflake instance" ^[17]. The group, calling itself Xuanyewen, claimed to the BBC that it used Simon AI, a platform built natively on Snowflake ^[18]. Snowflake has previously said its platform had not been breached ^[19]. Simon AI had been contacted for comment ^[18].

The decision in front of Asos this quarter is how its next statement is built. The company said it has "already taken additional steps to further strengthen security controls" ^[2], and it is still investigating how the hack happened ^[15]. If the scale of the breach again reaches the public before Asos publishes it, the company's own notices will count for less with customers it has already asked to be cautious of messages claiming to be from Asos ^[8].