科技 · 客户数据泄露ASOS 黑客窃取了客户搜索记录，也窃取了让诈骗看起来可信的联系方式文字 2026年10月8日 UTC 13:38观看文字实录0:09Hackers obtained ASOS customer profiles containing contact details and website0:14searches.0:15The possible scale reaches millions, but no affected person count is confirmed.0:19Combining shopping interests with ways to contact someone could make fraudulent0:22messages more convincing.0:24How much information was taken and what can customers actually know about their0:27exposure?0:28Searches included reclaimed vintage, glamorous wide fit, and ASOS Petite.0:33Those interests could give an unsolicited message a plausible shopping connection.0:37That is a fraud risk, not evidence that a particular customer has been defrauded or0:42that the records have been publicly released.0:44The detailed records include names, addresses, phone numbers, email addresses,0:48customer numbers, and website searches.0:50Potentially millions describes possible scale, not a verified total.0:55Neither the number of people affected, the number of profiles taken, nor the0:58download volume has been disclosed.1:00ASOS's disclosure has changed materially.1:03On 6th of October, basic personal information, including names and contact details,1:08might have been accessed.1:09By 8 October, detailed profiles were part of the disclosure.1:13The examined sample does not establish what every profile contains or the contents1:17of the complete collection.1:19The account-related category still lacks a full definition.1:22Names and contact details were accessed on third-party platforms, alongside1:26information described as non-personal and account-related.1:29That description cannot erase the fuller profile exposure.1:32The complete customer email and data set were not available for independent1:35examination.1:36An attacker impersonated a trusted contact, obtained an employee account's login1:41credentials, then used that access to reach customer information on third-party1:45platforms.1:46An unnamed service enabled the download.1:49This describes stolen account access, not an established technical vulnerability in1:53the underlying data platform.1:55The first access time, download time, and duration remain undisclosed.1:59So do the specific services reached and the employee account's permissions.2:03This is an interim explanation, not a completed public forensic reconstruction.2:07Restricting one notification service cannot by itself establish the extent of access2:11elsewhere.2:12The rogue notification reached phones in the United Kingdom and Australia.2:16It arrived on 6th of October at approximately 100 British Summer Time or 9002:22UTC.2:23That time stamps the customer-facing message, not the start of data access, and2:27these locations do not define the breach's full geography.2:30The notification threatened a data leak unless recipients engaged with the attackers2:35and included an external link.2:37Its claim of a fully compromised snowflake instance remains unverified.2:41There is no established ransom amount or evidence that a customer or ASOS paid the2:45attackers.2:46Dozens of recipients reported receiving the message.2:49That is not a total recipient count.2:51ASOS acknowledged it on Tuesday afternoon and restricted access to its notification2:55platforms that day.2:56The exact acknowledgement and restriction times are unknown.2:59The app and website were operating normally in the 6th to 7 October accounts.3:03Continued shopping availability does not undo information already obtained.3:07Customers were advised to disregard the unauthorized notification and not engage3:11with it, rather than follow the link or respond to its threat.3:15Snowflake's ongoing investigation had found no compromise of its platform so far.3:20The name Xuan Yeewen is attached to a separate, unverified claim of access through3:24Simon AI, described as built on Snowflake.3:27The precise environment accessed remains unresolved.3:30A customer-associated instance, a service built on Snowflake, and Snowflake's3:34underlying platform are different things.3:36Stolen credentials can expose a customer environment without establishing a breach3:40of the infrastructure provider.3:41The employee credential explanation does not independently validate the attacker's3:45specific platform claim.3:46The Telegram channel Xuan Yuan Gateway appeared in the notification and was created3:50on 6th October.3:52Its administering account had an earlier online history linked to gaming item3:55trading.3:56That association suggests an identity reorganized around the incident.4:00It does not identify a real-world attacker.4:02The forum name, matching profile, or identifier and a verified connection to the4:06intrusion remain unavailable.4:08It is also unproven that the channel controller, notification sender, and data thief4:12were the same person.4:13A 7 October finding of no possession proving samples preceded the 8 October profile4:18disclosure and sample examination.4:20The evidence advanced without proving full snowflake compromise.4:23Payment card information, bank details, and account passwords were not accessed in4:28the latest company assessment.4:29That is stronger than the initial wording that cards and passwords were not believed4:33impacted.4:34It does not make exposed contact details or search history harmless.4:37Customers were told they did not need to take action while also being warned about4:41unsolicited contact.4:42A separate precautionary recommendation was to change passwords and watch for4:46suspicious activity.4:48That recommendation is not evidence that ASO's passwords were stolen.4:51The precautionary warnings, verbatim wording, and the expert's organizational4:54affiliation are not established.4:56The practical distinction is between a confirmed password exposure, which is not5:00identified here, and taking an extra precaution while the scope of other exposed5:04information remains uncertain.5:06The UK Data Regulator publicly addressed the incident on 7th of October and5:11encouraged caution with links and attachments.5:13That establishes awareness, not receipt of a formal company breach notification.5:17On 6th October, ASOS had not informed the regulator as of the account published that5:21day.5:22By 8th of October, ASOS was working with law enforcement and regulators.5:26Whether and when it formally notified the Information Commissioner's office remains5:30unclear.5:31No confirmed receipt date or case-specific reporting deadline is established, so5:35there is no supported finding that ASOS missed a deadline.5:38Not receiving the push notification does not settle whether information was5:42accessed.5:43Precautionary advice to assume exposure has been described secondhand, but its exact5:48first-party wording is unavailable.5:50It is not a finding that every ASOS customer's information was taken.5:54The National Cybersecurity Center's incident page repeated the initial assessment5:58about names, contact details, cards, and passwords.6:01Assistance to ASOS was also described, but the available official passage does not6:05establish what was offered or delivered.6:08That gap does not prove assistance or advice was absent.6:10The Android app had more than 10 million Google Play downloads.6:14ASOS served around 17 million customers annually across more than 150 markets.6:19Downloads are cumulative installations, not active users or notification recipients.6:24None of these figures supplies an exposed profile count or a verified breach rate.6:28ASOS shares fell on 6th of October, but the reported measures differ: around 10%6:33that Tuesday, a 12% intraday maximum and 7% closing loss, and 10% overnight.6:39The around 10% and overnight descriptions do not establish exact observation times6:43or comparison prices.6:45The full day price record gives a 454.00 pence close and a6:49426.50 pence low.6:52A separately reported previous close is 502.00 pence.6:56The historical table excerpt did not include the prior day row, leaving that7:00denominator without a second checked record.7:02Using 502.00 pence, the close calculates to a 9.56% decline and the7:08daily low to 15.04%.7:10Another intraday account gave up to 13.2% and 439 pence, higher than the recorded7:16full day minimum.7:17These remain distinct accounts, not one settled percentage.7:20The conditional closing calculation fits around 10%, but differs from the reported7:247% close.7:25The conditional low-based calculation exceeds the reported 12% maximum.7:29No established evidence assigns the whole day's share movement exclusively to the7:32breach.7:33This was more than a notification system disturbance.7:36Customer profiles were obtained, but the total access window and full service list7:40remain undisclosed.7:41There is no completed public forensic report, law enforcement outcome, confirmed7:45regulator7:47notification date, or dated next announcement or investigation deadline.7:50The answer is that identifying details and website searches are part of the7:54exposure, but its full scale and individual reach remain unknown.7:58Customers still lack a definitive accounting of which records were taken, while8:02names, ways to contact them, and shopping searches may now sit together outside the8:06company's control.阅读文章事件时间线HeyDex短视频 ↗谁报道了什么多家媒体报道的要点Whether customer personal information was accessed4 家媒体Customers receiving an unauthorised app notification3 家媒体Whether payment-card information was affected3 家媒体Whether account passwords were affected3 家媒体ASOS share-price movement3 家媒体How an attacker obtained employee login credentials2 家媒体Customer searches included in stolen data2 家媒体Whether the ASOS website and app were operating normally2 家媒体仅一家媒体报道的要点16仅BBC News报道Whether hackers possessed detailed customer profiles10月8日 11:01 UTCPersonal details included in customer profiles10月8日 11:01 UTCASOS acknowledging the unauthorised notification10月6日 17:50 UTCASOS restricting access to notification platforms10月6日 17:50 UTCThreat made in the unauthorised notification10月6日 17:50 UTCSnowflake's findings about compromise of its platform10月6日 17:50 UTCWhether bank details were accessed10月8日 11:01 UTCHackers downloading customer data from a service10月8日 11:01 UTCASOS notifying the Information Commissioner's Office10月6日 17:50 UTCNational Cyber Security Centre assistance to ASOS10月6日 17:50 UTCAttackers' claimed method for accessing the data10月8日 11:01 UTCNumber of customers who received the notification10月6日 17:50 UTCAccess needed to send a push notification10月6日 17:50 UTC仅SBS News报道ASOS is investigating a cyber attack.10月7日 9:00 UTC仅The Guardian报道Third-party platforms accessed using stolen credentials10月8日 10:48 UTCAccess to non-personal account-related information10月8日 10:48 UTC每一行都是我们从该媒体报道中记录的说法。比较截至 2026年10月8日 UTC 15:32。
