ASOS confirmed that criminals accessed customer data after a fake "ASOS HACKED" push notification appeared on app users' phones on 6 October 2026. According to ASOS and BBC reporting, the stolen profiles include names, addresses, phone numbers, email addresses, customer numbers and search history, but ASOS says no payment card details or passwords were taken. The biggest risk now is follow-up phishing, so the most useful thing you can do is treat any message about the breach with suspicion.
Below I set out what is known so far, using only statements from ASOS, Snowflake and reputable news reports, and what is still unclear. Then I go through eight practical steps you can take today, including a privacy-safe way for developers to check whether a password has appeared in earlier leaks.
On the morning of Tuesday 6 October, ASOS app users across the UK saw a pop-up notification headed "ASOS HACKED". The message read: "Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it." It included a link to a Telegram channel.
The message looked genuine because it came through ASOS's real notification system. As the BBC's explainer for ASOS customers reports, the group behind it calls itself Xuanyewen, or Xuanye Group. Threat researchers at Group-IB said its Telegram channel was created on the same day the message went out.
Later that day ASOS said it had taken "immediate action to restrict access to the notification platforms" and was working with specialist advisers and the relevant authorities. The company's shares fell sharply on the news before partly recovering.
ASOS's investigation, shared with customers on 8 October, found that the attacker gained access to an employee account "by impersonating a trusted contact to obtain log in credentials". The attacker then used those credentials to "access information on certain third-party platforms used by ASOS".
In other words, this was social engineering rather than a technical flaw in ASOS's own website. The attacker tricked a person, not a server. That pattern has become very common in recent retail attacks.
The attackers claimed they had reached the data through Simon AI, a marketing platform built on top of Snowflake. Simon AI's owner had not commented publicly at the time of writing, so treat that part as a claim rather than a confirmed fact.
No, according to Snowflake. A Snowflake spokesperson told Infosecurity Magazine that the issue "did not in any way result from a vuln, weakness, flaw or misconfiguration with the Snowflake service, platform or internal environments" and that no action is needed by other Snowflake customers.
The mention of Snowflake in the push notification appears to refer to where some of the data was stored, not to a breach of Snowflake itself. Security researchers also pointed out that sending push notifications needs access to a separate messaging system, which supports the idea that several third-party tools were involved.
At first ASOS said only "basic personal information including name and contact details" may have been accessed. On 8 October, after the BBC said the criminals had sent it a sample, ASOS told customers that detailed profiles had been taken.
Reported as taken:
Reported as not taken:
ASOS says its website and app are working normally and that it will contact customers directly if they need to take further action. We don't yet know exactly how many people are affected. The BBC reports that it could be millions.
Leaked names, addresses and shopping history are gold for scammers. They let criminals write messages that sound convincing because they know who you are and what you buy.
Charlotte Wilson of Check Point told the BBC that "the biggest immediate risk may be what happens next", warning people to be "extremely suspicious" of messages about refunds, compromised accounts or password resets. The NCSC says breach-related scams often mention resetting passwords, receiving compensation, scanning devices or missed deliveries.
Expect to see things like:
Here is a practical checklist based on advice from ASOS, the NCSC, the ICO and Which?.
If you want a stronger option than passwords, many big retailers and email providers now support passkeys. I explain how they work and their trade-offs in are passkeys safe?.
If you build login systems, you can stop users from picking passwords that have already leaked in earlier breaches. The Have I Been Pwned Pwned Passwords API uses a k-anonymity model. You hash the password with SHA-1 and send only the first five characters of the hash. The service returns every matching suffix, and you compare the rest locally, so the full password or hash never leaves your machine.
import hashlib, urllib.request
def pwned_count(password: str) -> int:
sha1 = hashlib.sha1(password.encode("utf-8")).hexdigest().upper()
prefix, suffix = sha1[:5], sha1[5:]
req = urllib.request.Request(
f"https://api.pwnedpasswords.com/range/{prefix}",
headers={"User-Agent": "mfaysal-password-check", "Add-Padding": "true"},
)
with urllib.request.urlopen(req, timeout=10) as resp:
for line in resp.read().decode().splitlines():
h, count = line.split(":")
if h == suffix:
return int(count)
return 0
print(pwned_count("password123") > 0) # True
print(pwned_count("correct-horse-battery-staple-9f3k2q")) # 0
I ran this on 13 October 2026 and got the outputs shown. The range endpoint needs no API key. Use the result to warn users or block very common passwords at sign-up.
Scam messages after a breach often copy the real company's logo and tone, so the design tells you very little. Focus on what the message asks you to do instead. Warning signs include:
Real companies rarely ask you to confirm card details or passwords by email or text. If a message mentions your order history or home address, remember that the criminals may now hold exactly that information, so it doesn't prove the message is genuine. The safe habit is always the same: close the message and open the app yourself.
The attack did not need a zero-day exploit. It needed one convincing impersonation and access to third-party tools with broad permissions. Three lessons stand out for any team, large or small:
UK organisations must report qualifying personal data breaches to the ICO within 72 hours of becoming aware of them under UK GDPR.
Several questions remain open at the time of writing:
I will update this article if ASOS or the ICO publishes new information.
Yes. ASOS confirmed an unauthorised push notification and later told customers that criminals had taken customer profiles after gaining access to an employee account through impersonation.
Names, postal addresses, phone numbers, email addresses, customer numbers and search terms, according to ASOS and the BBC. ASOS says payment details and passwords were not accessed.
It is a sensible precaution. Change it only through the official app or by typing the website address yourself, and also change it anywhere else you reused it.
ASOS says payment card details were not taken, so cancelling isn't necessary. Keep an eye on your statements and contact your bank if you see anything unusual.
Snowflake says no. It found no vulnerability or misconfiguration in its platform and says other customers do not need to take action.
You often can't tell from the message alone. Don't click links in it. Open the ASOS app or type the web address into your browser and check your account there.
Forward scam emails to report@phishing.gov.uk and scam texts to 7726. If you have lost money, contact your bank straight away and report it to the police through the national fraud reporting service, or to Police Scotland on 101 if you live in Scotland.
UK GDPR gives you a right to claim compensation if a breach causes you damage or distress, but no scheme has been announced. Be very wary of any message offering ASOS compensation, because scammers use that exact lure.
The ASOS breach shows how one tricked employee and powerful third-party tools can expose millions of customer profiles. For shoppers, the practical answer is calm caution: change reused passwords, switch on two-step verification and assume any breach-related message is a scam until you have checked it yourself.
This article reflects public statements available on 13 October 2026. Details may change as the investigation continues.
// note
This is a learning note from studying the web. It is one small topic, written so I can remember it. It is not a course and not a claim that I have finished the subject.
If a sentence is wrong, say so from the contact page and name this title. Drafts never appear here. Related notes, when they exist, are other published posts, and the same sample rule applies to each of them.
The UK government plans to stop under-16s using platforms such as TikTok, Instagram, Snapchat, YouTube, Facebook and X from spring 2027. Here is what the official fact sheet says, how age checks might work, whether adults will need to show ID, and what it means for developers and parents.
Fingerprinting identifies your browser from dozens of small details, with no cookie to delete. Here is how it works (with a small tested demo), why "fingerprints are the new cookies" went viral this week, what the ICO says, and what actually helps: browsers, settings, VPNs and incognito.
A viral "Passkeys are a trap" post hit the top of Hacker News this week. Here is a balanced explanation of how passkeys work, why they stop phishing better than passwords, the genuine lock-in and attestation concerns, and how to use them without getting locked out.
A new GhostAction wave is using hijacked maintainer accounts to commit a fake "Security Audit" workflow that steals Actions secrets and every credential in your git history. Here is how the attack works, how to check your repositories (with a tested script), and what to rotate.