No, passwords were not taken in the breach at ASOS, the UK online fashion retailer. Payment details were not taken either. ASOS said its investigation found no account passwords were accessed, according to the update published by TheIndustry.fashion. It also found no payment-card information was accessed, according to the Infosecurity Magazine report.
Table of Contents
What was taken?
The intruder saw customer names and contact details. ASOS also described the haul as including certain non-personal account-related information. Later reporting added delivery addresses and recent on-site search histories from a sample seen by the BBC, according to the Reuters report.
That mix matters for shoppers. Names and contact details let criminals craft convincing fake messages. Non-personal account information does not include passwords or card numbers.
How did the attack happen?
Shoppers first saw trouble on 6 October 2026 at around 10am UK time. An unauthorised "ASOS HACKED" push notification went out through the ASOS app. The message travelled through a third-party communications platform.
ASOS said an unauthorised party impersonated a trusted contact to get an employee login. That login opened information held on certain third-party platforms. ASOS told the London Stock Exchange it was investigating that activity and had restricted access to those notification platforms. ASOS has not given a customer count for the incident. It has not publicly named every third-party platform involved.
Why was Snowflake named?
The attacker message named Snowflake, a cloud data platform. Snowflake is a service companies use to store and analyse large amounts of customer data.
Snowflake said its own investigation found no vulnerability, weakness, flaw or misconfiguration in its system. It said the issue was not caused by Snowflake.
Is it still safe to shop?
ASOS said its website and app remained safe to use throughout. That advice covers shopping, not inbox risk.
Exposed names and contact details raise the risk of phishing, which means fake emails or texts that pose as ASOS. Treat unexpected ASOS messages with care:.
- Do not click links or open attachments from an unexpected ASOS message.
- Open the ASOS app or type the ASOS address yourself to check orders.
- Never share passwords, card numbers or one-time codes with a messenger.
You Might Also Like
- ASOS Data Breach: What Names and Contact Details Were Hacked?
- ASOS Data Breach: Why Hackers Posed as a Trusted Contact to Dupe Staff
- ASOS Data Breach 2026: Hacked Push Alert, Customer Details and Searches Taken