ASOS Confirms Data Breach Following Social Engineering
ASOS said an attacker obtained an employee’s login credentials by impersonating a trusted contact. The attacker then accessed data on certain third-party platforms.
ASOS data breach details were clarified in a customer update dated October 8, 2026. The online retailer confirmed that an unauthorized party impersonated a trusted contact, obtained an employee’s login credentials through social engineering, and used them to access information on certain third-party platforms.
The company thus clarified its original October 6 announcement, which referred to unauthorized activity on third-party communication platforms and a fake push notification sent to customers. The new statement confirms that this involved not only misuse of a notification channel, but also access to some customer data.
ASOS data breach includes names and contact details
According to ASOS, some personal data, including names and contact details, was accessible. The company also said the access involved unspecified non-personal information associated with accounts.
ASOS continues to state that payment card data and customer account passwords were not accessible. The website and mobile app are said to be safe to use.
The company locked the affected platforms, is investigating the incident with internal and external experts, and is cooperating with law enforcement and regulatory authorities. However, it has not disclosed the number of affected customers, the full scope of the data accessed, or the name of the specific third-party provider.
Phishing is the biggest immediate risk
Access to names and contact details could make it easier for attackers to prepare convincing emails, text messages, or phone calls. Customers should be especially cautious with messages impersonating ASOS that require clicking a link, signing in, or providing additional information.
When checking orders or an account, it is advisable to open the ASOS app or manually enter the official website address instead of using a link from a message. ASOS has not confirmed that passwords were compromised, but caution with unexpected communications is relevant given that contact details were accessible.
Connection to Snowflake not confirmed
Attackers claimed they had compromised ASOS’s Snowflake environment. The retailer did not confirm this claim. ASOS’s current explanation indicates access through stolen employee credentials to certain third-party platforms, not confirmed compromise of the Snowflake service.
It is also not publicly known whether the relevant regulator has begun formal proceedings. ASOS may later clarify the categories of affected data, the number of affected individuals, and how it will contact customers individually.
Sources
- ASOS Customer Care – Unauthorized ASOS Notification – Confirms the original unauthorized push notification from October 6, the impact on third-party communication platforms, possible access to names and contact details, and that cards and passwords were not affected.
- ASOS plc – Update regarding cyber incident (RNS) – ASOS’s October 6 regulatory announcement confirms the original status of the incident, restricted access to notification platforms, and the ongoing investigation.
- Sky News – ASOS emails customers with update after hack – Quotes a new ASOS email update to customers describing the impersonation of a trusted contact, theft of an employee’s credentials, and the locking of affected platforms.
- The Guardian – Asos customers’ names, search histories and contact details accessed in hack, says retailer – Independently confirms the content of ASOS’s new update, including access to names, contact details, and certain non-personal account-related information.
Verified and updated: 10/08/2026 15:22
