ASOS confirmed customer names, home addresses, phone numbers and email addresses were exposed in a breach earlier that week, according to the Reuters report. A sample shared with the BBC also included dates of birth, customer numbers, account-start dates and website search terms, according to Malwarebytes reporting on the BBC findings. ASOS said no payment-card information or account passwords were accessed and operations were not affected, according to Infosecurity Magazine. The company confirmed the breach on October 8, 2026.
Table of Contents
- What customer data was exposed?
- How did the attackers get in?
- Why did shoppers receive an "ASOS HACKED" alert?
- What was not taken?
- What should shoppers watch for now?
What customer data was exposed?
ASOS described the loss as names and contact details plus certain non-personal account-related information. That wording covers direct identifiers shoppers use every day.
The BBC sample shows a wider mix. It paired names, home addresses, phone numbers and emails with customer numbers, dates of birth and account-start dates. It also included website search terms, which can reveal shopping interests and habits.
How did the attackers get in?
The attacker impersonated a trusted contact to obtain an employee's login credentials, according to Infosecurity Magazine. That technique is social engineering, not a password guess.
The attacker then used those credentials to access information on certain third-party platforms ASOS uses. Those platforms support customer communications and related services.
Why did shoppers receive an "ASOS HACKED" alert?
The incident became public on October 6, 2026 when attackers misused third-party communication platforms to send a rogue app push notification, according to the TechCrunch report. The message was headed "ASOS HACKED" and linked to a Telegram channel.
The notification claimed a Snowflake compromise. Snowflake said its investigation found no vulnerability, weakness, flaw or misconfiguration in its service, platform or internal environments, according to Infosecurity Magazine.
What was not taken?
ASOS told customers that no payment-card information was accessed, according to Infosecurity Magazine's coverage. Account passwords were also not accessed.
The company said the incident did not affect operations. Shoppers could still browse, order and use their accounts normally.
What should shoppers watch for now?
The main risk is targeted phishing that reuses stolen names, addresses and order or search details. A message may quote your address, birth date, customer number or a recent search to appear legitimate.
- Treat calls, texts and emails that use personal or order details as suspicious.
- Open the ASOS app or site directly instead of tapping message links.
- Verify unexpected requests through ASOS customer service channels.
- Delete the rogue October 6 push notification without following its Telegram link.
You Might Also Like
- ASOS Data Breach 2026: Hacked Push Alert, Customer Details and Searches Taken
- Burger King Japan Data Breach: 11.18 Million App Member Records Leaked
- Ahold Delhaize Cyberattack: Stop & Shop, Food Lion Offline, No Data Theft Found