Short answer
ASOS confirmed on 8 October 2026 that an unauthorized party impersonated a trusted contact to get an employee's login, then used it to reach customer data on third-party platforms. ASOS says payment card details and account passwords were not accessed. It has not said how many customers are affected.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | ASOS |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Online fashion retail |
| Country | United Kingdom |
| Detected | 2026-10-06 |
| Disclosed | 2026-10-06 |
| People or records affected | Number of customers not disclosed by ASOS |
What data was exposed
- Customer names
- Delivery and email addresses
- Phone numbers
- Certain non-personal account-related information (reportedly including recent search history, not confirmed by ASOS)
What happened
On Tuesday 6 October 2026, some ASOS app users received a push notification headed “Asos hacked” with a link to Telegram. Two days later, after a 48-hour investigation, ASOS confirmed that personal information had been accessed, as BleepingComputer and the Irish Examiner report.
ASOS said an unauthorized party impersonated a trusted contact to get an employee’s login credentials. The attacker then used those credentials to reach information on third-party platforms ASOS uses.
What ASOS says was taken
The retailer says the data includes full names and contact details. The Irish Examiner lists names, delivery and email addresses and phone numbers, plus “certain non-personal account related information”. That outlet says this is understood to include recent search history, but ASOS has not explicitly confirmed it.
ASOS says payment card details and account passwords were not accessed. It describes the exposed data as basic. A group calling itself Xuanye Group claimed to have stolen customer data, but not payment information. Treat the group’s claims as unverified.
How ASOS responded
ASOS locked down the affected platforms and started an investigation with external experts, law enforcement and regulators. It added security controls and said the website and app remain safe to use. It told customers they need not take action on their accounts.
BleepingComputer asked how many people were affected and had no figure when it published. We have not seen an official number, so we do not give one.
Why impersonation matters
The entry point was a person, not a software flaw. An employee was tricked by someone they believed they could trust. Customers face the same trick in reverse, because the stolen details let scammers pose as ASOS convincingly. See our guides on phishing messages and online shopping scams, and for texts about parcels, toll and delivery text scams. If you want a step-by-step response, use the data breach checklist.
What is still unknown
ASOS has not said how many customers are affected, how long the attacker had access, or whether search history was taken. Other outlets mention a larger earlier breach and a Snowflake link, but we could not confirm those with sources we opened. Browse the breaches index for related incidents.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake ASOS emails, texts and app-style notifications that use your real name and address to look genuine.
- Phone calls claiming to be ASOS 'security' or 'refunds' that ask for codes or card details.
- Delivery and order scams referencing your real address, such as a 'redelivery fee' link.
- Messages that claim your account was hacked and push you to a Telegram or other chat to 'resolve' it.
What to do if you are affected
- 01Ignore unexpected messages or calls claiming to be from ASOS. ASOS says it will never ask for passwords, security codes or payment details this way.
- 02Open the ASOS app or website yourself to check orders, rather than tapping links in messages.
- 03ASOS says customers need not take action on their accounts, but if you reuse your ASOS password elsewhere, change it anyway.
- 04Be wary of any message that mentions an order or delivery you do not remember placing.
- 05Report phishing texts to 7726 and phishing emails to report@phishing.gov.uk if you are in the UK.
Frequently asked questions
Was my data in the ASOS breach?
ASOS has not said how many customers are affected. If you have an ASOS account, assume your name, contact details and delivery address could have been accessed and watch for suspicious messages.
Were my ASOS password and card details stolen?
ASOS says payment card information and account passwords were not accessed. The attackers' own claims have not been independently verified.
Is ASOS safe to use now?
ASOS says its website and app remain safe and that it locked down the affected platforms and added security controls. The investigation with external experts, law enforcement and regulators is ongoing.
How did the ASOS hackers get in?
ASOS says an unauthorized party impersonated a trusted contact to obtain an employee's login credentials, then used them to access information on third-party platforms ASOS uses.
What was the 'Asos hacked' notification?
On 6 October some app users received a push notification claiming a hack and linking to Telegram. A group calling itself Xuanye Group claimed responsibility, according to BleepingComputer. Do not follow links in such messages.
Sources
- ASOS links data breach to social engineering attack, credential theft, BleepingComputer, 2026-10-08
- Asos says hacker accessed customers' search histories along with names and contact details, Irish Examiner, 2026-10-08
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.