TL;DR: In early October 2026 ASOS app users got a push notification reading “ASOS HACKED”, sent by attackers. ASOS confirmed that third-party platforms it uses to talk to customers were accessed and that names and contact details may be exposed. Samples given to the BBC reportedly also include addresses, phone numbers, dates of birth, customer numbers and the searches people made on ASOS. Passwords and card details were not accessed, ASOS says. Expect very personal-sounding phishing.
What happened
On a Tuesday morning in October 2026 ASOS shoppers received an in-app alert that simply said “ASOS HACKED”, addressed to the company’s data protection officer: “we have fully compromised the Snowflake instance. Engage with us, or we will leak it.” BleepingComputer reports that the message pointed to a Telegram channel run by a group calling itself “Xuanye.”
ASOS confirmed that third-party platforms it uses to communicate with customers had been accessed without authorisation, and said basic personal information, including names and contact details, may have been exposed. It told customers to ignore the rogue notification and not to click its link.
How they got in
According to Malwarebytes, ASOS says attackers tricked an employee into handing over login details, then used them to reach third-party platforms. The attackers first blamed Snowflake, which said its own platform was not compromised. They later claimed access came through a personalisation tool built on Snowflake.
What may have been taken
Per the BBC sample reported by Malwarebytes:
- names, home addresses, phone numbers and email addresses;
- customer numbers and dates of birth;
- searches made on the ASOS site (for example “glamorous wide fit”);
- when each customer started shopping with ASOS.
ASOS says payment card details and passwords were not accessed. The number of customers affected has not been published, and the attackers reportedly demanded a ransom within two weeks.
Why the search history part matters
Contact details leak all the time. Shopping searches are different. A phishing email that says “Your saved search for petite wide-leg jeans has a 70% discount, confirm your address to claim” feels like it came from ASOS because it knows things only ASOS should know. That is the risk here: not your card, but how convincing the next fake message can be.
What to do now
- Ignore any message about the breach, refunds or compensation that arrives by email, text or call. ASOS says it will contact affected customers directly and will never ask for passwords, codes or card details.
- Change your ASOS password anyway, and anywhere you reused it. Here’s how to check if a password has leaked.
- Turn on two-factor authentication on your email first, because your email resets everything else. See setting up 2FA.
- Watch for delivery-themed texts. Fake “your ASOS parcel is held” messages are an easy follow-up, see Evri text scams and Royal Mail text scams.
- Report phishing: forward emails to report@phishing.gov.uk and texts to 7726.
Where else has your email been?
If you shop online, your email has almost certainly been in more than one breach. A free email exposure check shows which ones, so you know what a scammer might already know about you. If you think you have lost money, report it to Report Fraud and see our guide to reporting fraud in the UK.
Can I complain or claim?
You can ask ASOS what data it holds on you with a subject access request, and complain to the ICO if you are unhappy with its response, see how to complain to the ICO.
Frequently Asked Questions
Was my card information stolen in the ASOS breach?
ASOS says payment card information and passwords were not accessed.
What data was exposed?
ASOS confirmed names and contact details may have been exposed. Samples given to the BBC reportedly also include addresses, phone numbers, dates of birth, customer numbers and site searches.
How did the attackers get in?
ASOS says an employee was tricked into giving up login details, which were used to access third-party platforms.
How do I know if a message from ASOS is real?
Don’t click links in unexpected messages. Open the ASOS app or website directly. ASOS says it will never ask for passwords, codes or card details.
Sources
- BleepingComputer: ASOS confirms data breach after hacked in-app notifications (Oct 6, 2026)
- Malwarebytes: ASOS breach update, customer details and shopping searches (Oct 9, 2026)
- TechCrunch: ASOS confirms breach of customer data
- Report Fraud (UK)