ASOS says customer data accessed after employee account breach

British online fashion retailer ASOS said an unauthorized party accessed some customers’ personal information after obtaining an employee’s login credentials through impersonation.

The credentials were used to enter third-party platforms employed by ASOS, the company said Thursday following a 48-hour investigation. The exposed information included names and contact details, such as delivery and email addresses and phone numbers, as well as some non-personal account information. The Guardian and BBC reported that recent customer search histories were among the data accessed.

ASOS said payment-card information and account passwords were not compromised. It immediately locked down the affected platforms and said its website and app remained safe to use.

The breach became public Tuesday when app users received a push notification titled “ASOS HACKED.” Addressed to the retailer’s data protection and IT teams, it claimed the company’s Snowflake instance had been compromised, threatened to leak information and linked to a Telegram channel. ASOS urged customers not to engage with the notification and warned them to remain cautious of unexpected messages or calls claiming to come from the company.

The retailer said it was working with law-enforcement and regulatory authorities and had strengthened its security controls. The number of affected customers was not specified. ASOS shares fell sharply Tuesday after the notification emerged, before recovering some ground later in the week.