ASOS Data Breach: Customer Details, Search History and a “Snowflake” Access Claim Explained

Online fashion retailer Asos has confirmed a data breach that exposed a large collection of customer and staff records after a group of attackers social-engineered its employees, tricking them into handing over access to the company’s systems. The leak includes far more than names and emails — and one of the most dangerous parts of the dataset is what customers searched for on the site.

What was actually in the leak

According to reports from security researchers, the disclosed data spans an estimated 2–5 million customers plus staff, and includes a stack of personal fields that, on its own, is already enough to build a compelling impersonation:

• Identity and contact details: customer and account names, dates of birth, billing, shipping and home addresses, phone and mobile numbers, email addresses, and customer or account numbers.
• Relationship data: the date customers first ordered from the site, and the number of items purchased.
• Search history: terms customers typed into the site’s search box — samples in the leaked data include niche and lifestyle queries such as “reclaimed vintage,” “glamorous wide fit,” and “Asos petite.”

What was not accessed, the researchers said, was payment-card data and password hashes. That distinction matters: this is an identity-and-intent breach, not a stolen-credentials-and-bank-data breach. The risk is not “your card was cloned” but “someone now knows a great deal about you.”

Why the search history changes the risk

Names, addresses and phone numbers are common in most retail breaches. Search terms are not. A list of the specific things a person has looked for — down to niche styles and brand variants — gives an attacker material for highly targeted, contextual social engineering: fake messages and pages that reference exactly what the victim cares about or is looking for. It is the kind of detail that turns a generic phishing email into something a victim trusts.

The researchers reported that the leaked data was shared with several data brokers — the same brokers whose records are already aggregated on the dark web. Once the data sits in that ecosystem, the practical question is no longer whether it can be found, but how and by whom.

The “Snowflake” access claim

One element of the breach is worth treating with an appropriately skeptical eye. Some reports and leaked documentation suggest the attackers also gained access to a company instance of Snowflake, the data-warehouse platform Asos has reportedly used, in an effort to steal additional data. Because that specific claim is less well-established than the leaked file itself, it belongs in the “reported, not fully confirmed” category — worth watching, not to be treated as settled fact yet.

How the attack happened

The breach is a classic social-engineering play: rather than breaking through technical controls, the attackers got a human to hand over access. For a retailer, that means the failure is often less about a patched-out-of-date system and more about people being convinced to share credentials, approve prompts, or open doors in internal tools. Once inside, the attackers gathered whatever was reachable — here, a broad customer-relationship and behavioural dataset.