ASOS customers were told about a break-in by the company’s own app

On the morning of October 6, 2026, some ASOS customers got a push notification from the ASOS app that ASOS did not send. The company later said the path in was an employee account: someone impersonated a trusted contact, obtained that employee’s login, and used it on third-party platforms ASOS uses to communicate with customers.

If you have never bought from ASOS, this is not your account. If you have, the UK’s National Cyber Security Centre says to assume you are affected even if you never saw the notification.

What ASOS has said

The first public statement was a London Stock Exchange announcement at 15:15 on October 6. It said an unauthorized customer notification went out at around 10 a.m. that day, that ASOS was investigating unauthorized activity on third-party platforms it uses to talk to customers, and that it had cut off access to the notification platforms. At that point ASOS said basic personal information, including name and contact details, may have been accessed. It did not believe payment-card information or account passwords were affected. The website and app were still up.

The later note on ASOS’s own customer page is firmer, and it adds the path. An unauthorized party got into an employee account by impersonating a trusted contact to obtain the login. Those credentials were used on certain third-party platforms. The investigation, ASOS said, found access to some personal information, including names and contact details, and to certain non-personal account information. It again said no payment card information and no account passwords were accessed. ASOS said there is no action to take on the ASOS account itself, and that it will contact customers directly if a later stage of the investigation says they need something more.

ASOS does not, in those two statements, name the platform or say whether the impersonation was a phone call, an email, or something else. It does not give a count of customers. A report that fills those gaps in is ahead of what the company has confirmed.

The NCSC note matches the company’s description and adds the instruction the company left implicit: if you are an ASOS customer, assume you are affected, including if the notification never arrived.

Why the notification matters

The break-in was announced to customers through a channel they had already agreed to trust. That is useful to the people who have the data. Anyone who then sends a text saying “ASOS here, confirm your card so we can protect the account” is borrowing a story the victim has already heard from the real app.

ASOS’s page says the company will not ask for passwords, security codes, or payment details in an unsolicited message or call. The NCSC’s general breach advice is the same shape: confirm you are affected from the organization’s own site, then watch for the follow-on contact. We wrote up the phone-call version of this pattern in the calls behind this year’s large thefts. ASOS has not said this incident was a phone call. The shared piece is the impersonation of someone the employee was supposed to trust.

Card numbers and ASOS passwords were not what ASOS says was accessed. Changing your ASOS password is not the fix the company asked for. Changing a password you reused on other sites is still reasonable if you cannot remember where else that password went, because contact details plus a reused password is a common next step. It is not a step ASOS’s notice requires.

What to do

1. Read ASOS’s page, not a link in a text. The customer update lives on asos.com. A message that leads somewhere else, or that asks for a code or a card, is the follow-on, not the notice.
2. If you are a customer, assume your name and contact details were available, even without the push. That is the NCSC’s line. It does not mean your card number was taken. ASOS says it was not.
3. Do not “verify” the account by typing a password or a card into a form someone sent you. ASOS says there is nothing to do on the account, and that it will write to people if that changes.
4. If you are in Canada and you shopped there, the same messages apply. There is no separate Canadian filing in the notices above. Unexpected mail that cites the ASOS incident and asks for a payment is the thing to ignore. Our notes on what to do after a breach cover the rest: watch the account you actually have, and don’t hand a second copy of your information to a stranger who mentions the first leak.

Sources

• ASOS Plc, Update regarding cyber incident, Regulatory News Service, October 6, 2026
• ASOS, Unauthorised notification: customer update
• UK National Cyber Security Centre, Incident affecting ASOS customers