British online fashion retailer Asos has begun telling customers that personal information was exposed in a cyberattack, according to Expressen. The company sent an email to shoppers confirming that customer data had leaked, the Swedish outlet reports.
The attack hit Asos on Tuesday, Expressen writes. Customers subsequently received a push notification through the company's app in which the attackers threatened to publish personal information. Asos confirmed the intrusion a few hours later.
Why it matters
Asos is one of the largest online fashion sellers in the world, with more than 16 million customers globally and revenue above 30 billion Swedish kronor last year, according to Expressen. A breach touching that customer base carries consequences well beyond the company itself.
The disclosure also moved markets. Expressen reports that news of the attack sent the company's share price sharply lower on the London Stock Exchange, with a drop of just over ten percent.
What the company says was taken
In its message to customers, Asos said the attackers obtained phone numbers, email addresses, home addresses and names, per Expressen. The company stated that credit and debit card details were not among the compromised data, and that passwords were not leaked either.
The email told recipients that the full-scale investigation will continue over the coming weeks, while offering customers an update in the meantime, Expressen reports.
Asos also warned customers in that email to be careful about phone calls and unexpected messages, according to Expressen.
Experts warn of convincing phishing
The Guardian, cited by Expressen, spoke with experts who said the extra information now in attackers' hands could help them build "highly convincing" phishing scams aimed at Asos customers. The combination of a real name, a working phone number, a home address and an email address gives a fraudster enough material to make a message look legitimate.
That concern lines up with the company's own advice to stay alert to unsolicited contact. Customers who receive a call or message claiming to come from Asos should treat it with suspicion, particularly if it asks for login details or payment information.
A week of coverage across Swedish media
The story drew wide attention in Sweden. Expressen, Computer Sweden, Aftonbladet, EFN and Affärsvärlden all reported on the incident, with Computer Sweden describing the Asos hack as worse than previously known and Affärsvärlden noting that the company had confirmed the attack.
EFN focused on the market reaction, reporting that the fashion retailer's share fell after news of the hack. The push notification sent through the app, in which the attackers themselves threatened to release personal data, was an unusual element of the case and helped push the story into mainstream coverage.
Asos has not said publicly who was behind the attack, and no motive has been established in the reporting so far. The company has not indicated how many customers are affected within its global base.
What to watch
The investigation is expected to continue for weeks, and the key questions are how many customer records were accessed and whether the leaked data surfaces anywhere online. Customers should watch for unexpected calls or messages referencing details that only a legitimate company would normally know.
