Quick answer
The ASOS data breach disclosed after an unauthorised notification on 6 October exposed some customer names and contact details. ASOS says no payment-card information or account passwords were accessed. Customers should be alert to follow-up phishing and check unexpected messages through ASOS’s official customer-care page. If you gave a password or payment details to a suspicious message, act on that separate exposure promptly.
A notification arriving through a familiar shopping app can feel trustworthy. This incident shows why the channel alone is not enough to establish that a message is genuine. The immediate consumer issue is what an unexpected message asks you to do.
What ASOS has confirmed
ASOS customers received an unauthorised push notification on 6 October 2026. The retailer’s current customer update, checked on 12 October, says someone impersonated a trusted contact to obtain an employee’s login credentials. The credentials were used to access certain third-party platforms. ASOS says it locked down the affected platforms and brought in external investigators.
The company confirms access to some names, contact details and certain non-personal account-related information. Its current findings say no customer passwords or payment-card information were accessed, and that its website and app remain safe to use. These are ASOS’s findings; the investigation continues. The update does not give a final affected-customer count or a complete breakdown of every account-data field.
Who should take precautions?
The National Cyber Security Centre’s 6 October alert advises ASOS customers to assume they could be affected, even if they did not receive the notification. That is a precaution, not confirmation that every customer’s records were accessed.
Names and contact details can help make an impersonation message convincing. The NCSC warns that suspicious messages may arrive after the initial incident. A supposed refund, password reset or account-security check deserves independent verification, particularly if it asks for credentials, a security code or a payment.
Choose the action that matches your exposure
Receiving a notification and handing information to a scammer are different situations. Use this decision matrix to avoid unnecessary account changes while responding quickly to a real disclosure.
| Your situation | Useful next step |
|---|---|
| You received a message but shared nothing | Check the official update independently. Avoid suspicious links and watch for follow-up messages. |
| You entered a password on a suspicious page | Change it through the genuine service. Change any accounts using the same password, and check account activity. |
| You shared card details or lost money | Contact your bank promptly through its official app or the number on your card. Report the suspected fraud. |
ASOS says customers do not need to take action on their accounts because of this incident. That advice does not cover a password you separately entered into a phishing page. The NCSC’s data-breach guidance for individuals and families recommends changing exposed or reused passwords and checking for unfamiliar account activity.
Open the genuine service yourself rather than following a message’s link or supplied phone number. ASOS says it will not request passwords, security codes or payment details in an unsolicited message or call. Even a message that knows your name is not proof of authenticity.
For longer-term credential protection, use separate passwords and two-step verification where available. Impulsec’s password-manager safety guide explains the benefits and limits of storing unique passwords. No security tool makes a request for a password or payment automatically trustworthy.
Where to report suspicious messages
In the UK, forward suspicious emails to [email protected] and suspicious texts to 7726. The NCSC phishing-reporting guidance also explains how to report scam websites and calls, and what to do after sharing information. Outside the UK, use your local reporting service. If money is involved, contact your bank first.
The practical priority is to separate ASOS’s confirmed incident from any new demand arriving in your inbox. Follow the official update, verify unexpected contact independently, and respond to information you actually disclosed.
Sources
- ASOS customer-care incident update (checked 12 October 2026).
- NCSC: incident affecting ASOS customers (6 October 2026).
- NCSC: data breaches, guidance for individuals and families.
- NCSC: spotting and reporting phishing scams.
Related Articles
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.