テクノロジー · 顧客データの情報漏えいASOSへのハッキングで顧客の検索履歴と、詐欺を信じ込ませるための情報が窃取された執筆 2026年10月8日 13:38 UTC視聴文字起こし0:09Hackers obtained ASOS customer profiles containing contact details and website0:14searches.0:15The possible scale reaches millions, but no affected person count is confirmed.0:19Combining shopping interests with ways to contact someone could make fraudulent0:22messages more convincing.0:24How much information was taken and what can customers actually know about their0:27exposure?0:28Searches included reclaimed vintage, glamorous wide fit, and ASOS Petite.0:33Those interests could give an unsolicited message a plausible shopping connection.0:37That is a fraud risk, not evidence that a particular customer has been defrauded or0:42that the records have been publicly released.0:44The detailed records include names, addresses, phone numbers, email addresses,0:48customer numbers, and website searches.0:50Potentially millions describes possible scale, not a verified total.0:55Neither the number of people affected, the number of profiles taken, nor the0:58download volume has been disclosed.1:00ASOS's disclosure has changed materially.1:03On 6th of October, basic personal information, including names and contact details,1:08might have been accessed.1:09By 8 October, detailed profiles were part of the disclosure.1:13The examined sample does not establish what every profile contains or the contents1:17of the complete collection.1:19The account-related category still lacks a full definition.1:22Names and contact details were accessed on third-party platforms, alongside1:26information described as non-personal and account-related.1:29That description cannot erase the fuller profile exposure.1:32The complete customer email and data set were not available for independent1:35examination.1:36An attacker impersonated a trusted contact, obtained an employee account's login1:41credentials, then used that access to reach customer information on third-party1:45platforms.1:46An unnamed service enabled the download.1:49This describes stolen account access, not an established technical vulnerability in1:53the underlying data platform.1:55The first access time, download time, and duration remain undisclosed.1:59So do the specific services reached and the employee account's permissions.2:03This is an interim explanation, not a completed public forensic reconstruction.2:07Restricting one notification service cannot by itself establish the extent of access2:11elsewhere.2:12The rogue notification reached phones in the United Kingdom and Australia.2:16It arrived on 6th of October at approximately 100 British Summer Time or 9002:22UTC.2:23That time stamps the customer-facing message, not the start of data access, and2:27these locations do not define the breach's full geography.2:30The notification threatened a data leak unless recipients engaged with the attackers2:35and included an external link.2:37Its claim of a fully compromised snowflake instance remains unverified.2:41There is no established ransom amount or evidence that a customer or ASOS paid the2:45attackers.2:46Dozens of recipients reported receiving the message.2:49That is not a total recipient count.2:51ASOS acknowledged it on Tuesday afternoon and restricted access to its notification2:55platforms that day.2:56The exact acknowledgement and restriction times are unknown.2:59The app and website were operating normally in the 6th to 7 October accounts.3:03Continued shopping availability does not undo information already obtained.3:07Customers were advised to disregard the unauthorized notification and not engage3:11with it, rather than follow the link or respond to its threat.3:15Snowflake's ongoing investigation had found no compromise of its platform so far.3:20The name Xuan Yeewen is attached to a separate, unverified claim of access through3:24Simon AI, described as built on Snowflake.3:27The precise environment accessed remains unresolved.3:30A customer-associated instance, a service built on Snowflake, and Snowflake's3:34underlying platform are different things.3:36Stolen credentials can expose a customer environment without establishing a breach3:40of the infrastructure provider.3:41The employee credential explanation does not independently validate the attacker's3:45specific platform claim.3:46The Telegram channel Xuan Yuan Gateway appeared in the notification and was created3:50on 6th October.3:52Its administering account had an earlier online history linked to gaming item3:55trading.3:56That association suggests an identity reorganized around the incident.4:00It does not identify a real-world attacker.4:02The forum name, matching profile, or identifier and a verified connection to the4:06intrusion remain unavailable.4:08It is also unproven that the channel controller, notification sender, and data thief4:12were the same person.4:13A 7 October finding of no possession proving samples preceded the 8 October profile4:18disclosure and sample examination.4:20The evidence advanced without proving full snowflake compromise.4:23Payment card information, bank details, and account passwords were not accessed in4:28the latest company assessment.4:29That is stronger than the initial wording that cards and passwords were not believed4:33impacted.4:34It does not make exposed contact details or search history harmless.4:37Customers were told they did not need to take action while also being warned about4:41unsolicited contact.4:42A separate precautionary recommendation was to change passwords and watch for4:46suspicious activity.4:48That recommendation is not evidence that ASO's passwords were stolen.4:51The precautionary warnings, verbatim wording, and the expert's organizational4:54affiliation are not established.4:56The practical distinction is between a confirmed password exposure, which is not5:00identified here, and taking an extra precaution while the scope of other exposed5:04information remains uncertain.5:06The UK Data Regulator publicly addressed the incident on 7th of October and5:11encouraged caution with links and attachments.5:13That establishes awareness, not receipt of a formal company breach notification.5:17On 6th October, ASOS had not informed the regulator as of the account published that5:21day.5:22By 8th of October, ASOS was working with law enforcement and regulators.5:26Whether and when it formally notified the Information Commissioner's office remains5:30unclear.5:31No confirmed receipt date or case-specific reporting deadline is established, so5:35there is no supported finding that ASOS missed a deadline.5:38Not receiving the push notification does not settle whether information was5:42accessed.5:43Precautionary advice to assume exposure has been described secondhand, but its exact5:48first-party wording is unavailable.5:50It is not a finding that every ASOS customer's information was taken.5:54The National Cybersecurity Center's incident page repeated the initial assessment5:58about names, contact details, cards, and passwords.6:01Assistance to ASOS was also described, but the available official passage does not6:05establish what was offered or delivered.6:08That gap does not prove assistance or advice was absent.6:10The Android app had more than 10 million Google Play downloads.6:14ASOS served around 17 million customers annually across more than 150 markets.6:19Downloads are cumulative installations, not active users or notification recipients.6:24None of these figures supplies an exposed profile count or a verified breach rate.6:28ASOS shares fell on 6th of October, but the reported measures differ: around 10%6:33that Tuesday, a 12% intraday maximum and 7% closing loss, and 10% overnight.6:39The around 10% and overnight descriptions do not establish exact observation times6:43or comparison prices.6:45The full day price record gives a 454.00 pence close and a6:49426.50 pence low.6:52A separately reported previous close is 502.00 pence.6:56The historical table excerpt did not include the prior day row, leaving that7:00denominator without a second checked record.7:02Using 502.00 pence, the close calculates to a 9.56% decline and the7:08daily low to 15.04%.7:10Another intraday account gave up to 13.2% and 439 pence, higher than the recorded7:16full day minimum.7:17These remain distinct accounts, not one settled percentage.7:20The conditional closing calculation fits around 10%, but differs from the reported7:247% close.7:25The conditional low-based calculation exceeds the reported 12% maximum.7:29No established evidence assigns the whole day's share movement exclusively to the7:32breach.7:33This was more than a notification system disturbance.7:36Customer profiles were obtained, but the total access window and full service list7:40remain undisclosed.7:41There is no completed public forensic report, law enforcement outcome, confirmed7:45regulator7:47notification date, or dated next announcement or investigation deadline.7:50The answer is that identifying details and website searches are part of the7:54exposure, but its full scale and individual reach remain unknown.7:58Customers still lack a definitive accounting of which records were taken, while8:02names, ways to contact them, and shopping searches may now sit together outside the8:06company's control.記事を読むストーリーの時系列HeyDexショート動画 ↗誰が何を報じたか複数のメディアが報じた論点Whether customer personal information was accessed4媒体Customers receiving an unauthorised app notification3媒体Whether payment-card information was affected3媒体Whether account passwords were affected3媒体ASOS share-price movement3媒体How an attacker obtained employee login credentials2媒体Customer searches included in stolen data2媒体Whether the ASOS website and app were operating normally2媒体1社だけが報じた論点16BBC Newsのみが報道Whether hackers possessed detailed customer profiles10月8日 11:01 UTCPersonal details included in customer profiles10月8日 11:01 UTCASOS acknowledging the unauthorised notification10月6日 17:50 UTCASOS restricting access to notification platforms10月6日 17:50 UTCThreat made in the unauthorised notification10月6日 17:50 UTCSnowflake's findings about compromise of its platform10月6日 17:50 UTCWhether bank details were accessed10月8日 11:01 UTCHackers downloading customer data from a service10月8日 11:01 UTCASOS notifying the Information Commissioner's Office10月6日 17:50 UTCNational Cyber Security Centre assistance to ASOS10月6日 17:50 UTCAttackers' claimed method for accessing the data10月8日 11:01 UTCNumber of customers who received the notification10月6日 17:50 UTCAccess needed to send a push notification10月6日 17:50 UTCSBS Newsのみが報道ASOS is investigating a cyber attack.10月7日 9:00 UTCThe Guardianのみが報道Third-party platforms accessed using stolen credentials10月8日 10:48 UTCAccess to non-personal account-related information10月8日 10:48 UTC各行は、そのメディアの報道から私たちが記録した主張です。2026年10月8日 15:32 UTC時点で比較。
