Asus confirms eShop data breach exposed customer order records and contact details — payment data safe, but firm warns of targeted phishing scams

If you bought anything on Asus' web store, you should check your inbox. The company has reported that its online shop suffered a data breach, and that contact details and order records "may have been accessed."

Asus says that no payment or financial information was revealed. However, Asus is not saying how large the breach was, or which regions had records leaked. The firm only indicates "part of the Asus eShop environment," a statement that is quite vague. Since the eShop is segregated by region and country, there's also no word on which locations were affected.

No information was offered on the duration of the breach or who may be behind the attack. There is no publicly posted statement, except for what people who have received the email have shown.

Asus says it "promptly took steps" to contain the breach, and that it has not identified any ongoing access. The firm also states that an investigation is in progress, and is advising customers to be extra careful, as the leaked information could be used to convincingly impersonate Asus and used for phishing attacks. For example, someone claiming to be from Asus may reach out about a recent order and offer your name, address, and order information as proof they're legitimate.

Anyone with compromised credentials should keep an eye out for unexpected emails, phone calls, SMS, or online messages claiming to be from Asus. Don't click any links or scan any QR codes contained in those messages - be sure to manually visit the websites in question in your browser.

Likewise, don't hand out any personal info or passwords during any phone calls, much less accept any requests for remote access software unless you are fully aware you're speaking to actual support. As always, be sure to enable two-factor authentication (aka 2FA or MFA) so that thieves can't access your accounts even if they hold your password.