ASOS says hackers stole customer details and search data in app breach
ASOS says hackers accessed names, addresses, phone numbers, dates of birth and search terms after impersonating a trusted contact, but no card details or passwords were taken.
The Full Story
A plain summary built from the channels that reported this story.
ASOS has confirmed that hackers accessed the personal data of potentially millions of customers after a push notification was sent from its app on Tuesday morning. The notification, titled 'ASOS Hacked', appeared at around 10am and reached customers in the UK and reportedly in the US, France, Australia and Sweden. It was addressed to ASOS's data protection officer and IT team and said: 'we have fully compromised the snowflake instance, engage with us or we will leak it.' The message included a link to the messaging app Telegram. Snowflake is a cloud platform used to store, process and analyse data. ASOS, which owns brands including Topshop and Miss Selfridge, has around 17 million customers worldwide.
Using the retailer's own app to send a ransom note is highly unusual. Cyber security experts said attackers usually leave ransom notes quietly inside a compromised system or contact the company directly. The public nature of the notification suggested the hackers were trying to force ASOS into negotiations and may have been desperate to get paid. Because ASOS's app has been downloaded 10 million times on Google Play alone, millions of phones may have received the alert.
ASOS initially said little, then told the stock exchange that basic personal information may have been accessed. Its share price fell by more than 10%. In an email update later, the company said the breach was wider than first thought. It said an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain login credentials. The affected platforms were locked down immediately.
The data now known to be in the hands of criminals includes names, addresses, phone numbers, email addresses, customer numbers and dates of birth. The hackers also provided a sample showing search terms that customers had entered on the ASOS website or app, such as reclaimed vintage, glamorous wide fit and ASOS petite. ASOS said it does not believe payment card information or account passwords were accessed. It said its website and app are safe and operating normally.
ASOS has not said how many customers are affected. It said it is working with internal and external specialist advisers and relevant authorities. In a statement, the company said customer trust is incredibly important and promised an update if the situation changes. Some customers said they were worried, scared to use the app, or wanted compensation.
Security experts warned that the stolen profiles could be used for more convincing phishing emails, calls or scams. Customers have been advised to be vigilant about unexpected messages, calls or emails claiming to be from ASOS. They should also change or rotate passwords, especially if the same password is used for banking or other important accounts.
The incident follows a series of cyber attacks on UK retailers in the past two years. Marks & Spencer, Harrods and the Co-op have all been targeted. M&S saw online sales disrupted earlier this year. Harrods warned customers that personal information may have been stolen. A breach at the Co-op reportedly cost more than 200 million pounds in revenue.
The hackers have been referred to as the Joanne group, and cyber security experts said they appear to be a new cybercrime gang. The investigation is ongoing.
On screen
Stills are sampled automatically at 60-second intervals. Where shown, the still is the nearest available frame from the relevant broadcast segment and is included to show what was on screen during that part of the broadcast. A still may not correspond to the exact second of a quoted phrase.
Key Claims
Claims reported during this story's coverage, grouped by how many channels reported each one. Select a dot to see the source excerpt.
| Claim |  |  |  |  |  |
|---|---|---|---|---|---|
| Widely reported · 4 or more of 5 channels | |||||
| Thousands of ASOS customers received a message or alert claiming ASOS had been hacked. | |||||
| Reported by a few · 2–3 channels | |||||
| ASOS said basic personal information including names and contact details may have been accessed, but it did not believe payment card information or account passwords were impacted. | Not reported by BBC One | Not reported by Channel 4 | Reported by ITV | ||
| ASOS share prices fell by more than 10% after the notification. | Not reported by Channel 5 | Reported by BBC One | Not reported by Channel 4 | ||
| ASOS hackers reportedly gained access by impersonating a trusted contact to obtain login information. | Not reported by BBC One | Not reported by Channel 4 | Reported by ITV | Not reported by Sky News | |
| Only on one channel | |||||
| ASOS said it was investigating unauthorised activity involving third-party platforms used to communicate with customers, with access restricted. | Not reported by Channel 5 | Not reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Reported by Sky News |
| At an early stage, it was not confirmed whether the ASOS incident was a hack or a spoof, and the scale was unclear. | Not reported by Channel 5 | Not reported by BBC One | Not reported by Channel 4 | Reported by ITV | Not reported by Sky News |
| Hackers were reported to have access to some back-end systems of the ASOS app. | Not reported by Channel 5 | Not reported by Channel 4 | Not reported by ITV | Not reported by Sky News | |
| The affected messages were reported in the UK and potentially in the US, France and Australia. | Not reported by Channel 5 | Reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Not reported by Sky News |
| The alert appeared to come from a hacker. | Not reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Not reported by Sky News | |
| The data accessed in the ASOS incident was unknown because ASOS had not issued a statement. | Not reported by Channel 5 | Not reported by Channel 4 | Not reported by ITV | Not reported by Sky News | |
| UK retailers including M&S and Harrods have been targeted by cyber attackers over the past two years. | Not reported by Channel 5 | Not reported by BBC One | Reported by Channel 4 | Not reported by ITV | Not reported by Sky News |
Channel Perspectives
What each channel focused on, with key quotes.
Channel 4 gave the story a short, early mention. It focused on the apparent customer alert, the message title and the Telegram link, and placed the incident in the context of earlier cyber attacks on M&S and Harrods. It did not carry the later confirmation that wider customer data had been taken.
- “Thousands of customers of ASOS have been sent a phone alert saying the online fashion retailer has been hacked.”
- “Customers received a mobile app notification titled ASOS Hacked, which directed them to a Telegram account.”
- “A number of UK retailers have been targeted by cyber attackers over the past two years, including M&S and Harrods.”
5 treated the story as a consumer and security issue across its lunchtime and evening bulletins. It used experts to explain how unusual it was for hackers to announce an attack so publicly, and gave practical advice on passwords and suspicious messages. Its later coverage reflected ASOS's confirmation that a trusted contact had been impersonated and that names and contact details were accessed.
- “a cryptic message was sent to customers at around 10 a.m. This morning now, we'll take a look at it What is unusual about this though is it appears to be from the hackers themselves?”
- “We don't often see this kind of public claim quite often attackers will breach a system They will leave a ransom note on that system.”
- “ASOS hackers gained access by impersonating a trusted contact to get login information, the retailer has said.”
BBC ONE West gave the most detailed and escalating coverage. It used a cyber correspondent to explain the technical details, including the Snowflake platform, the possibility of international victims, and the later evidence that names, addresses, dates of birth and search terms had been taken. It also highlighted the share price fall and named the apparent hacking group.
- “The online fashion retailer ASOS appears to have been hacked with customers across the UK receiving an apparent extortion message on their phones.”
- “We know that they have got names, addresses, phone numbers, email addresses, customer numbers and date of birth.”
- “The ASOS hackers are calling themselves Joanne group and they seem to be a brand new cybercrime gang”
ITV1 focused on the market impact and what the breach meant for consumers. Its correspondents explained the Snowflake reference, the share price fall and the later admission that an employee account was accessed through impersonation. It also aired customer worries and calls for compensation.
- “This sounds unusual, even in the age of cyber attacks at this early stage. What more do we know?”
- “The notification, as you might expect, bewildered some customers, but it also spooked the markets, too. Share prices for ASOS dropped by over 10% after it happened.”
- “They say we discovered that an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain login credentials.”
Sky News kept to a short, straight news report. It led on ASOS's statement, quoting the company's confirmation of an unauthorised notification and its belief that payment card data and passwords were not affected, then noted the share price fall. It did not add expert analysis or the later, wider data update.
- “ASOS can confirm that around 10 a.m. today An unauthorized customer notification was sent to ASOS customers”
- “Basic personal information including name and contact details May have been accessed We do not believe that payment card information or account passwords were impacted”
- “ASOS's share price has tumbled The value falling by more than 10% earlier today”
Broadcast Timeline
News broadcasts tracked for this story, in time order.