ASOS customers warned about suspicious messages after data breach
The UK data protection regulator has told ASOS customers not to open links in unexpected messages about their account, after hackers got hold of names and contact details belonging to some customers.
ASOS customers should be careful with unexpected texts and emails about their account, the Information Commission said in a statement on 7 October. It came the day after ASOS said some customers' names and contact details may have been accessed.
On 6 October, some ASOS customers got an unauthorised notification on their phones from the ASOS app. ASOS told the London Stock Exchange that day that it was investigating unauthorised activity involving outside services it uses to contact customers.
What the companies say
In an update on 8 October, ASOS said that someone had got into an ASOS employee's account by pretending to be a trusted contact, City AM reported. ASOS said that this person got some personal information, including names and contact details. ASOS said it had reported the incident to the police and the relevant regulators.
On 6 October, ASOS said it did not believe that payment card details or account passwords were affected, and that its website and app were working as normal.
ASOS has not said how many customers are affected or which countries they live in.
What it means for consumers
The National Cyber Security Centre advises that anyone who is an ASOS customer should assume they are affected, even if they did not get the notification. It warns that scam messages can arrive some time after a breach.
Paul Arnold, Chief Executive of the Information Commission, said:
We understand how unsettling it can be to receive a message from apparent hackers claiming to have access to your personal information.
The regulator advised people to:
- be careful with links and attachments, and not open links in unexpected texts or emails about their account
- log in directly through the official ASOS website or app if they want to change their password
- never share personal or financial information in reply to unexpected contact
- check bank accounts and online accounts for anything unusual
- use strong, unique passwords and turn on extra login checks
People can complain to the company and then complain to the Information Commission. They might be able to claim compensation if the company broke data protection law and this caused them loss or distress. Our guide explains what to do after a data breach.