Online retailer’s 26% jump sharpens focus on exemption letting cheap parcels into the country duty-free
Shein, the online fast-fashion retailer founded in China, increased sales in the UK by just over a quarter last year, overtaking its British rival Asos.
The company, whose global parent group listed on the Hong Kong stock exchange valued at just over $26bn (£19.6bn) last month, increased sales at its UK division by 26% to £2.58bn, according to accounts filed at Companies House.
The customer data stolen from global fashion retailer ASOS includes more than just names and contact details, raising questions about its early reassurances.
As we reported earlier this week, ASOS customers received a push notification through the ASOS app alleging that the company had been hacked.
ASOS has confirmed that attackers accessed customer information after tricking an employee into handing over login credentials. While the retailer says payment card information and customer passwords were not accessed, reporting by the BBC shows the stolen information includes more than the “basic personal information” initially mentioned by the company.
The stolen login details were used to access information on third-party platforms used by ASOS. The company says it locked down the affected platforms and launched an investigation with internal and external specialists. It also says it has strengthened its security controls.
What data was stolen?
In our initial coverage, we highlighted the potentially detailed customer profiles associated with ASOS’s marketing setup. The BBC’s findings now establish that at least some shopping-related information was taken.
According to the BBC, which received a sample from the attackers, the exposed data includes:
Names and home addresses
Phone numbers and email addresses
Customer numbers and dates of birth
Searches customers made on the ASOS website
Details such as when a customer started using ASOS
The BBC reported search terms including “reclaimed vintage,” “glamorous wide fit,” and “Asos petite.” That makes this more than a stolen contact list. The information can also reveal customers’ shopping interests and their relationship with the retailer.
The attackers’ original notification named Snowflake, a data storage and analysis platform. They subsequently told the BBC that they accessed the information through Simon AI, a platform built on Snowflake that ASOS uses for customer personalization.
Snowflake said it had found no compromise of its platform. Using stolen credentials to access a customer’s account or a connected service does not necessarily mean the underlying platform was breached. The available reporting does not establish a vulnerability in Snowflake or Simon AI.
ASOS’s communication with customers
Customers first heard about the breach from the cybercriminals, rather than the retailer. The attackers’ decision to send a notification through the ASOS app may have made that unavoidable.
But the Independent reported that ASOS’s full statement followed roughly five hours of silence, leaving customers alarmed by the notification and waiting for an explanation.
Security expert Kevin Beaumont criticized the response:
“ASOS are experiencing the exact same PR gaffs as Co-op and M&S by not being honest with customers. If you’re dealing with Advanced Persistent Teenagers you need much better crisis plans.”
While the attackers are threatening to release the data, ASOS says its full investigation will continue over the coming weeks. It will contact customers directly where it believes further information, support, or action is required.
Reportedly, the group gave ASOS two weeks to make contact and said it wanted a ransom in exchange for deleting customer information. ASOS did not disclose whether it would pay.
How to stay safe
ASOS says its website and app remain safe to use, and that payment card information and customer passwords were not accessed. But the stolen details and shopping searches could help scammers make targeted phishing messages more convincing.
A message that knows your name, or what you searched for, isn’t proof it came from ASOS.
Be wary of unexpected emails, texts, or calls about the breach, refunds, deliveries, or problems with your ASOS account.
Don’t follow links in unexpected messages, and don’t follow the Telegram link in the attackers’ message or engage with them. Go directly to the ASOS website or app to check your account.
Don’t share passwords, security codes, or payment details in response to an unsolicited message or call. ASOS says it will never ask you to do this.
Your name, address, and phone number may already be for sale.
Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way.
Thousands of global fashion retailer ASOS customers have received a push notification through the ASOS app this morning alleging that the company has been hacked.
The notification, addressed to ASOS’s data protection officer and IT, says:
“ASOS HACKED
Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it”
What we know so far
Snowflake is a cloud-based data platform that organizations use to store, process, and analyze data. We know that ASOS’s marketing team uses Simon AI from a blog posted by Simon. Simon AI specializes in personalization and runs on Snowflake. ASOS has described using Simon AI alongside Braze to personalize and trigger customer communications like push notifications to clients’ phones.
The apparent delivery of the message through ASOS’s own app makes this more concerning than an unsupported social-media claim. It suggests unauthorized use of the notification infrastructure, but does not confirm that the claimed Snowflake compromise occurred or that customer data was stolen.
According to Simon AI, typical customer profiles cover:
browsing history and products viewed
purchase history and customer value (first-time or high-value buyers)
demographic data
segments such as Premier status or customers who’ve stopped buying
geolocation and local weather
If the affected systems contain these profiles, a breach could expose a detailed picture of customers’ shopping habits and preferences. However, the published description of ASOS’s marketing setup does not establish what, if anything, the attackers accessed.
The Guardian reports that the group claiming the breach calls itself the “Xuanye group.” The Telegram channel operated by the group carried the message “Regarding Asos, payment information is not affected,” and the “app is safe to use” but those claims have not been independently verified.
Sky News reports that ASOS confirmed an “unauthorised customer notification” was sent at around 10 am today.
“We are investigating unauthorised activity involving third-party platforms that we use to communicate with customers,” it said in a statement.
The retailer said it immediately restricted access to the notification platforms and is working with specialists and relevant authorities.
It added:
“Basic personal information including name and contact details may have been accessed. We do not believe that payment-card information or account passwords, were impacted.”
How to stay safe
The website and app remain operational, and there is currently no verified evidence that customer databases, payment card information, passwords, etc. have been stolen.
So, it’s too early to say if and how much ASOS customer data the attackers could get their hands on, but the potential scope is significant. Customer data could be used in targeted phishing attacks to add credibility.
For the time being, postpone your purchases at ASOS until it’s clear what happened and whether ASOS has resolved the issue.
Be wary of unsolicited messaging about the breach or other ASOS related issues.
If you do not wish to see more push notifications from the Xuanye group, remove the ASOS app until their access has been removed.
Shares in fashion company fall nearly 10% after its app systems are accessed by ‘unidentified third party’
Asos is investigating unauthorised access to its app system after shoppers received a notification claiming hackers had “fully compromised” its data.
The online fashion retailer said basic personal information including name and contact details might have been accessed by an unidentified third party but it did not believe payment card records or passwords had been compromised.
From pillboxes and boaters to bicornes and buckets, characterful hats are making their way from the catwalk to the high street
“Here goes – an order for a million hats,” wrote Jackie Kennedy to Bergdorf Goodman before moving into the White House in the early 1960s. It’s a line that could have been uttered by any number of people working in fashion today, because the hat – and not just the ubiquitous baseball cap – has been enjoying a very characterful resurgence.
This season at the turbo-high-end brand Loro Piana, whose clothes are beloved by tech bros and Kendall Roy, almost every model was wearing a hat. At Thom Browne, straw boaters came shrouded in colourful mesh. At Chloé there were see-through hats to match see-through trenchcoats and white sailor hats atop all-white outfits. Courrège’s hats were space-age, Burberry had big buckets, Bottega Veneta had hats brimming with charisma.
Login
