ASOS employee tricked into handing over login credentials; customer data and search history stolen and app push abused

The UK NCSC said some ASOS customers received an unauthorized push notification from the ASOS app on October 6, and the company confirmed customer names and contact details were accessed ^[1]. According to BleepingComputer and the BBC, the attacker impersonated a trusted contact to obtain an employee's login credentials and accessed third-party platforms, taking names, addresses, phones, emails, customer numbers, birth dates and site search history, but not payment cards or passwords ^[2][3]. The NCSC advises ASOS customers to assume they are affected, not click suspicious links in push notifications, emails or messages, and watch for suspicious messages arriving later ^[1].

Industries mainly affected: Retail

1. Assume you are affected and do not click suspicious links in push notifications, emails or messages ^[1].
2. Watch for suspicious messages that may arrive some time after the breach .