BBC reporting published on 8 October 2026 says ASOS customers were told that hackers took detailed customer profiles, including dates of birth and website search terms—more than the names and contact details mentioned in the retailer’s earlier notice. ASOS said passwords and bank details were not accessed, but the number of affected customers and full scope remain unknown.
What happened at ASOS?
On 6 October 2026, some customers received an unauthorised push notification through ASOS’s app system. ASOS told customers to disregard the notification and not click its external link. The retailer said it restricted access to the notification platforms, brought in specialist advisers and notified relevant authorities. BBC reporting published two days later described a broader set of customer information in the profiles attackers obtained.
As an Amazon Associate I earn from qualifying purchases.
What customer information was reportedly taken?
The BBC reported that ASOS told customers that profiles had been taken. The reported fields were names, addresses, phone numbers, email addresses, customer numbers, dates of birth and website search terms. ASOS’s earlier public notice had said names and contact details may have been accessed. It said it did not believe payment-card information or account passwords had been impacted. Those are the retailer’s statements; they do not establish that every possible risk has been ruled out.
The BBC said ASOS did not answer questions about the scale of the incident. No confirmed affected-customer count has been reported. A possible scale described as “potentially millions” is not a verified count.
#1 Best Overall
How did the attackers reportedly get access?
ASOS’s reported explanation was that an attacker impersonated a trusted contact to obtain login credentials for an employee account, then used access to an unnamed service to download customer data. This account-compromise route is distinct from a confirmed breach of the Snowflake platform.
The unauthorised notification claimed that a Snowflake instance had been compromised; the attackers also told the BBC they had used Simon AI. Those are attacker claims, not established technical findings. The BBC noted that Snowflake had previously said its platform was not breached.
What can I do to protect myself after an “ASOS hacked” message?
Follow ASOS’s current instructions
- Disregard the unauthorised notification and do not click or interact with the external link it contained.
- For updates, open the ASOS website or app directly rather than following a link in an unexpected message.
- ASOS said it was not then asking customers to change their ASOS password or take any other action.
ASOS has also said it will not ask for passwords, security codes or payment details through unsolicited contact. Treat a message or call cautiously even if it includes personal details that make it seem genuine.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchReduce the risk from unexpected contact
The UK Information Commissioner’s Office (ICO) advises people to stay alert to unexpected messages, avoid their links and sign in to an account through the official website or app if they want to make a change. ICO chief executive Paul Arnold said: “If you want to change your password, log in to your account directly through the official website or app and update it in the usual way.”
- Never provide personal or financial information in response to unexpected contact.
- Monitor bank accounts and online services for unusual activity.
- Use strong, unique passwords and enable multi-factor authentication (MFA) on services that support it. These are general account-security steps, not a specific ASOS incident requirement.
The ICO’s guidance on unexpected contact and account security is available at ico.org.uk/for-the-public/identity-theft/. Technical guidance on WebAuthn describes hardware authenticators and origin-scoped credentials, but it does not establish that ASOS supports security keys; compatibility depends on each service. See W3C Web Authentication: An API for accessing Public Key Credentials.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Does this mean every ASOS customer will be targeted?
No. The reported exposure could make impersonation or phishing more convincing because a criminal may use details such as an address, date of birth or search terms to make a message sound credible. But the reporting does not show that every customer will be contacted or defrauded, and the exact number of affected people and complete technical scope have not been established.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
