For: ASOS customers, anyone who got the "ASOS hacked" alert on their phone, and teams that send app-wide push notifications to customers. This article is based on ASOS's own statements as reported by news outlets, and it does not cover attack techniques.
Developing: this article will be updated as ASOS publishes more
As of October 30, 2026Not yet known
- Number of customers affected
- Whether dates of birth and search history were taken (ASOS has not confirmed)
- Whether the data has been published
- Results of the investigation
ASOS says its investigation is ongoing and that it will share more if significant findings emerge. It also says it will contact customers directly if they need more information, support or action.
What ASOS customers should do today
Ignore the fake alert
On October 6, 2026, customers received an app notification titled "ASOS hacked" that pointed to a messaging-app account. ASOS told customers to disregard it and not to click or engage with the external link in it.
If it is still on your phone, delete it. Do not message the account it names.
Check your account yourself
ASOS says its website and app are safe to use. Open the app you already installed, or type the web address yourself. Do not use a link from a text, email or alert.
ASOS says no action is needed on accounts. If you reuse your ASOS password on other sites, changing it is a sensible habit, and turning on a second check helps (Choosing multi-factor authentication).
Be careful with messages that quote your name or searches
Names, email addresses, phone numbers and home addresses are what scammers use to make a message look real. If the BBC's report is right, dates of birth and search terms could be used too. A message that uses them does not prove it came from ASOS.
ASOS says it will never ask for passwords, security codes or payment details through unsolicited messages or calls. See What is phishing? and Smartphone security basics.
Do not engage with anyone offering to deal with the data
Do not contact the account named in the fake alert. The UK National Cyber Security Centre has offered support to ASOS and advises people not to click suspicious links and to watch for messages that use the news of the breach (as reported by the Press Association).
What happened (from ASOS's statements and press reports)
Oct 6, morning (UK)
Customers receive an unauthorised push notification through the ASOS app titled "ASOS hacked". It links to a messaging-app account. ASOS later confirms that an unauthorised notification reached customers (Press Association).Oct 6, 15:15 (UK)
ASOS posts a stock-exchange announcement titled "Update regarding cyber incident" (London Stock Exchange record, 06 October 2026). We could not read the body of the announcement; the content below comes from press reports of ASOS's statement.Oct 6
ASOS says it is investigating unauthorised activity involving third-party platforms it uses to communicate with customers, that it restricted access to those platforms, and that it is working with specialist advisers and relevant authorities. It says names and contact information may have been accessed and that it does not believe payment card details or account passwords were affected.Oct 8
BleepingComputer reports a further ASOS customer update: an unauthorised party obtained an employee's login credentials by impersonating a trusted contact, and used them to access information on certain third-party platforms. In early October the BBC reported on a sample supplied by the attackers (as summarised by Malwarebytes, Oct 9).
- Notification
- An unauthorised notification reached customers through the ASOS app on October 6, 2026
- Data accessed
- Full names, contact details and "certain non-personal account-related information" (ASOS statement, as reported)
- Not affected (ASOS belief)
- Payment card information and account passwords
- Cause
- An employee's login credentials were obtained by impersonating a trusted contact, then used to access information on certain third-party platforms (ASOS statement, as reported by BleepingComputer)
- Response
- Affected platforms locked down; investigation with external experts, law enforcement and regulators; extra security measures added (ASOS statement, as reported)
- Service
- Website and app operating normally
What is known and what is not
| Item | What was published | Status |
|---|---|---|
| Names | Accessed | Confirmed (ASOS customer update of Oct 8, as reported by BleepingComputer) |
| Contact details | Accessed | Confirmed (ASOS customer update of Oct 8, as reported by BleepingComputer) |
| "Certain non-personal account-related information" | Accessed | Confirmed (ASOS customer update of Oct 8, as reported by BleepingComputer) |
| Home addresses, phone numbers, email addresses | In the attackers' sample | Reported (BBC), not confirmed by ASOS |
| Customer numbers and dates of birth | In the attackers' sample | Reported (BBC), not confirmed by ASOS |
| Searches made on the ASOS website | In the attackers' sample | Reported (BBC), not confirmed by ASOS |
| Payment card information | Not believed affected | Not included (ASOS belief) |
| Account passwords | Not believed affected | Not included (ASOS belief) |
| Number of customers affected | Not published | Not disclosed |
| Whether the data has been published | The attackers reportedly threatened to release it | Unknown (ASOS has not said) |
| Misuse of the data | Not reported by ASOS | No information |
| Cause | Employee credentials obtained by impersonation, used on third-party platforms | Stated by ASOS; no technical detail |
| Fault at the third-party platforms | The cloud data platform provider says it found no compromise of its platform | Not established |
A separate notice from earlier this year is not part of this
Press has reported a separate, earlier account-compromise case at ASOS's US business. It is a different incident, and this site does not combine the two.
Names and contact details (ASOS)
Customer number and date of birth (BBC report)
Website search history (BBC report)
↓
Texts or emails that greet you by name
Calls that sound like they know your account
Offers that match your searches
↓
Close the message and open the real app yourself
Never give passwords, codes or payment details
Do not contact the account in the fake alert
What data like this makes possible
This section is general, not a report of what has happened.
- Name plus email or phone: a message that greets you by name looks genuine. This is the usual base for fake delivery, refund and "your account" texts.
- Date of birth plus customer number: lets a caller sound like someone who knows your account when they ask you to "confirm your identity".
- Search history: it shows interests, not a password, but it can make a fake offer look personal.
If any of these reach you, the safe move is the same: close the message and open the real app.
For teams that send push notifications or use outside data platforms
ASOS's account points to two lessons: the alert came through platforms used to reach customers, and the starting point was an employee account.
Check requests from a 'trusted contact' through a second channel
ASOS said login credentials were obtained by impersonating a trusted contact. Ask staff to confirm unusual requests for logins, resets or access with the person through a separate, known channel. See Credential-first breaches in 2026.
Protect the accounts that can message every customer
Limit who can send app-wide notifications, require multi-factor authentication on those accounts and on data platforms, and alert someone when a campaign is created outside normal hours. See Choosing multi-factor authentication.
Prepare a customer message in advance
The Independent, as summarised by Malwarebytes, reported that ASOS's full statement came about five hours after the alert reached phones. Keep a short, ready-to-send notice that tells customers what to ignore.
Sources (public record)
We could not read the body of ASOS's stock-exchange announcement or its customer update with our tools. The facts above come from the reports below, which quote or summarise ASOS's statements. Items from the BBC are cited as reported by other outlets, and we have not read the BBC article ourselves.
- ASOS PLC, "Update regarding cyber incident", London Stock Exchange RNS 8604X, 06 Oct 2026 (title and time only) — londonstockexchange.com
- Press Association via Irish News, "Asos apologises to customers after 'unauthorised activity'" (Oct 6, 2026) — irishnews.com
- TechCrunch, "ASOS confirms breach of customer data after hackers send rogue app notification" (Oct 8, 2026) — techcrunch.com
- BleepingComputer, "ASOS links data breach to social engineering attack, credential theft" (Oct 8, 2026) — bleepingcomputer.com
- Malwarebytes, "ASOS breach update" (Oct 9, 2026), summarising BBC, Independent and Yahoo reports — malwarebytes.com
Update history
2026-10-30: First version, based on ASOS's statements of October 6 and 8 as reported by the Press Association, TechCrunch, BleepingComputer and Malwarebytes.
Read next
- Credential theft as the way in: Credential-first breaches in 2026
- Defending against impersonation: What is phishing? / Smartphone security basics
- For operators: Choosing multi-factor authentication
- Other 2026 cases: Data breaches and cyberattacks in 2026