ASOS breach: hackers stole customer details and used the app to send a fake 'hacked' alert
ASOS customers got a rogue 'ASOS HACKED' app alert on 6 Oct after attackers used a phished employee login. Names, contact details and search history were taken; ASOS says cards and passwords weren't. Ignore its link and treat unexpected ASOS messages with suspicion.
Ignore and don't tap links in the 'ASOS HACKED' alert. Be wary of unexpected emails, texts or calls claiming to be ASOS, which says it will never ask for passwords, security codes or payment details; ASOS says no account action is needed.
What’s happening
On 6 October 2026, ASOS customers received a push notification through the retailer's own app saying ASOS had been hacked and that data would be leaked unless the company engaged with the attackers. ASOS told the London Stock Exchange that unauthorised people had accessed third-party platforms it uses to communicate with customers. It later said an employee was tricked by someone impersonating a trusted contact, and the stolen login was used to reach those platforms. ASOS says full names, contact details and some non-personal account information were involved, and that payment card details and passwords were not accessed. The BBC, via TechCrunch and Malwarebytes, reported that a sample from the attackers also included home addresses, customer numbers, dates of birth and shopping searches. A group calling itself Xuanye Group claimed responsibility; its claims are unverified. Snowflake says its systems were not breached. ASOS has not said how many of its roughly 17 million customers are affected. No leak of the data had been confirmed in the sources found, and ASOS said its investigation continues.
- What
- Breach
- Affects
- ASOS customer accounts and app
- Fixed in
- Nothing to patch
- Since
- 6 Oct 2026
- Closed
- 9 Oct 2026
Timeline
- Update
Malwarebytes reported that a sample the attackers gave the BBC included customer numbers, dates of birth and search terms. The attackers reportedly gave ASOS two weeks to make contact and demanded a ransom; the article did not confirm any leak or whether ASOS would pay.
- Update
TechCrunch reported, citing the BBC, that the data also included home addresses, phone numbers, email addresses and customers' website search queries. Snowflake said its own systems were not breached, and it remained unclear how the attackers reached the push notification system.
- Update
ASOS said an unauthorised party impersonated a trusted contact to obtain an employee's login credentials, then used them to reach third-party platforms. Data involved was full names, contact details and some non-personal account information; ASOS said card details and passwords were not accessed. It said it had locked down the platforms and added security measures.
- Update
A group calling itself Xuanye Group claimed responsibility on Telegram. ASOS did not confirm the Snowflake claim or give a number of affected customers, and added an in-app notice telling users to ignore the alert and not click its link.
- Made publicNothing to patch
Attackers used ASOS's own app to push an unauthorised 'ASOS HACKED' alert to customers, claiming to have compromised a Snowflake instance and threatening to leak data. ASOS told the London Stock Exchange it was investigating unauthorised activity on third-party platforms it uses to talk to customers, and said names and contact details may have been accessed.
Sources
- ASOS PLC cyber incident update (RNS)ASOS PLC · 6 Oct 2026
- ASOS confirms data breach after hacked in-app notificationsBleepingComputer · 6 Oct 2026
- ASOS links data breach to social engineering attack, credential theftBleepingComputer · 8 Oct 2026
- ASOS confirms breach of customer data after hackers send rogue app notificationTechCrunch · 8 Oct 2026
- ASOS breach update: Hackers stole customer details and shopping searchesMalwarebytes · 9 Oct 2026