ASOS Data Breach 2026: Exposed Details and What Customers Should Check

Direct answer

ASOS confirmed customer information access in its October 8 update after stolen employee credentials were used on third-party platforms. Names and contact details were accessed; card information and account passwords were excluded by the company. Additional sample-derived fields need attribution, and receiving the notification does not prove your phone was hacked.

Original event dates and this article

The issuer RNS was released October 6 at 15:15:21 BST. Reuters published the October 8 confirmation at 06:01 EDT (10:01 UTC), inside the fixed window. The exact time of the underlying customer notice was not exposed. This is a substantiated reporting follow-up, not a newly discovered October 9 breach.

What happened?

In its initial 6 October regulatory announcement, ASOS said an unauthorised customer notification had been sent at about 10:00 BST. At that stage, the company said that basic personal information, including names and contact details, may have been accessed. It said it did not believe payment-card information or account passwords had been affected.

ASOS’s later customer update followed a detailed investigation. The company said an unauthorised party gained access to an employee account by impersonating a trusted contact and obtaining login credentials. Those credentials were then used to access information on certain third-party platforms used by ASOS.

The company said the affected platforms were locked down immediately, preventing further access, and that it was working with cyber specialists, law enforcement and regulators. ASOS also said it had taken additional steps to strengthen its security controls.

This is a confirmed unauthorised access and data-exposure incident. It has not been described as a software vulnerability, and there is no affected product version or security patch for shoppers to install. The company has not said that its website or app was taken offline, encrypted, or disrupted.

What information was exposed?

ASOS confirmed that names and contact information were accessed. Its customer wording also referred to “certain non-personal account related information.” Independent reporting provided more detail after the BBC reviewed a sample of data supplied by people claiming responsibility for the incident.

The reported fields include:

The sample reported by the BBC is important context, but it should not be treated as a complete list for every affected customer. ASOS has not published a full field-by-field inventory or confirmed how many customers were affected. Reports referring to potentially millions of profiles describe possible scale, not a measured number supplied by the company.

ASOS has said that payment-card information and account passwords were not accessed. The company also says it will not ask customers to share passwords, security codes or payment details through an unsolicited call or message.

The references to Snowflake and the group calling itself Xuanye Group came from the unauthorised notification and related claims. They should not be treated as proof that Snowflake itself was breached. Reporting at the time said Snowflake had found no compromise of its platform. The exact relationship between the third-party communication systems and the data environment remains unclear.

• full names;
• delivery and email addresses;
• phone numbers;
• customer numbers;
• dates of birth; and
• recent searches made on the ASOS website, such as products or styles a shopper had looked for.

How can customers check?

There is no indication that customers need to download an update or replace a device. Continue to use the ASOS website or app by opening it directly, rather than following a link in the notification or a later message.

If you received the “ASOS HACKED” alert, save a screenshot if you still have one, but do not click its Telegram or other external link. Customers who receive an email, text or call referring to the incident should treat it as untrusted until independently verified. Do not use contact details supplied in that message. Open ASOS through a known address or use the contact details in a trusted account record.

Because names, contact details and shopping-related information can make a scam sound convincing, watch for messages about refunds, account checks, delivery problems, password resets or unusual orders. A message that knows what you searched for can still be fraudulent.

ASOS says customers do not need to take action on their accounts at this stage. Changing a password is still reasonable if you reuse it elsewhere, but do not change it through a link in an unsolicited message. Use a unique password and enable two-step verification on email and financial accounts where available. Monitor bank and payment accounts for unusual activity, while remembering that ASOS says payment-card details were not accessed.

What remains unknown?

ASOS has not disclosed the number of affected customers, whether all listed fields applied to every person, or whether the data was publicly released. It has also not provided a complete technical description of the third-party platforms or confirmed every allegation made by the purported attackers. The investigation remains ongoing, and the company says it will contact customers directly where additional information, support or action is required.

For now, the clearest risk is targeted impersonation. Someone who knows a customer’s name, contact details, date of birth or recent searches may be able to make a phishing message appear genuine. Do not provide passwords, one-time codes, payment details or identity documents in response to an unexpected contact.

Was my phone or ASOS app hacked?

Not necessarily. The unauthorised message was sent through an ASOS customer-notification system. Receiving it does not mean the phone itself was compromised. ASOS says its website and app remained safe to use, but customers should avoid links contained in the unauthorised notification.

Do I need to cancel my card or change my ASOS password?

ASOS says payment-card information and account passwords were not accessed, and it says customers do not currently need to take action on their accounts. Do not cancel a card solely because of the notification unless your bank advises it or you see suspicious activity. Change a reused password as a general security measure, using the official site directly, and never disclose a password or security code to an unsolicited contact.

Decision checklist

• Open the retailer through a known genuine address rather than a notification link.
• Save suspicious notifications without following their links.
• Separate company-confirmed fields from sample-derived reporting.
• Reject requests for passwords, payment details and one-time codes from unsolicited contacts.
• Review reused credentials through a trusted account page, not a message link.
• Check for targeted refund, delivery or account-verification scams.

Limitations

• Customer wording confirmed access and described impersonation of a trusted contact to steal employee credentials. Company-confirmed names/contact details must be separated from extra fields in a purported-attacker sample reported by the BBC. ASOS excludes payment-card information and account passwords; the number affected and a full per-customer field inventory remain unknown.
• Reviewed 9 October 2026; source-event dates differ from this article’s first publication.
• General defensive guidance is not a diagnosis or complete-cleanup guarantee.
• No verified query volume, Google Trends score, victim total or ranking guarantee is asserted.

Evidence sources

1. ASOS issuer RNS — ASOS issuer RNS — initial scope, exclusions and lockdown
2. Reuters — Reuters October 8 — customer-update wording and credential impersonation
3. BBC — BBC October 8 — sample-derived extra fields; attribute rather than universalize
4. BleepingComputer — BleepingComputer — independent technical corroboration