ASOS data breach: what customers should know

A shopping notification became a security warning. ASOS confirmed that an unauthorized message was sent to customers on October 6, 2026. Two days later, BleepingComputer reported a company update linking the incident to stolen employee login details.^{1, 2}

Reporting checked October 8, 2026.

Too long; didn’t read?

• ASOS initially said names and contact details might have been accessed.¹
• BleepingComputer’s October 8 report says ASOS subsequently confirmed exposure of names, contact details and some account-related information.²
• The same report says ASOS told customers that payment-card information and account passwords were not accessed.²

What ASOS says happened

In its October 6 regulatory statement, ASOS said it was investigating unauthorized activity involving outside platforms used for customer communications. It said it had restricted access to the notification platforms and was working with specialist advisers and the relevant authorities.¹

According to the customer notice reviewed by BleepingComputer on October 8, someone impersonated a trusted contact to obtain an employee’s credentials. ASOS said those credentials were then used to access information on third-party platforms. BleepingComputer reported that it had not received an affected-customer count.²

ASOS’s initial statement also said its website and app were operating normally, without disruption to its operations. It described the investigation as ongoing and said it would provide an update if the situation changed. Those were the company’s statements on October 6, rather than an independent assessment of its systems.¹

The attackers’ claim is a separate question

BleepingComputer reported on October 6 that the unauthorized alert claimed access to ASOS’s Snowflake environment and threatened a leak. The publication said the group had not supplied evidence establishing that access.³

ITPro reported Snowflake’s response that day: its investigation had found no compromise of the Snowflake platform and was continuing. That statement concerns the platform; it does not resolve every question about ASOS’s customer data.⁴

Why follow-up messages deserve care

The National Cyber Security Centre warns that scammers exploit current news to make their messages seem relevant. It also says criminals use information available about people online to make phishing more convincing. A message that mentions a real incident still needs checking.⁵

The same guidance identifies urgency, authority and emotion as warning signs: a message may claim to come from an official source, demand an immediate response or try to frighten you into acting. Stop and check the sender through a separate, official channel.⁵

What customers can do

• Leave the alert’s link alone. BleepingComputer reported that ASOS instructed customers to disregard the unauthorized notification and avoid its external link.³
• Check unexpected messages independently. The UK’s National Cyber Security Centre advises contacting an organization through details on its official website, rather than those supplied in a suspicious message.⁵
• If you shared a password or banking details with a scammer, act on that. NCSC guidance recommends changing passwords on accounts using the disclosed password, or contacting your bank if you supplied banking information.⁶

Keep the two situations separate: receiving an alert and handing information to someone through its link call for different responses.

Report suspicious follow-ups. In the UK, the NCSC provides guidance for reporting suspicious emails without clicking their links. It also says most phone providers accept suspicious texts forwarded to 7726; if that does not work, contact your provider for its reporting route.^{7, 8}

Sources

1. ASOS plc, October 6, 2026: Update regarding cyber incident (regulatory statement linked from ASOS’s investor website)
2. BleepingComputer, October 8, 2026: ASOS links data breach to social engineering attack, credential theft
3. BleepingComputer, October 6, 2026: ASOS confirms data breach after unauthorized in-app notifications
4. ITPro, October 6, 2026: ASOS users report concerns; includes Snowflake’s response
5. National Cyber Security Centre: How to spot a scam email, text message or call
6. National Cyber Security Centre: If you’ve shared sensitive information
7. National Cyber Security Centre: Report a scam email
8. National Cyber Security Centre: Report a scam text