ASOS Data Breach: What Hackers Took and What to Do Now

Your shopping app sends you a notification, but this time it comes from hackers. The ASOS data breach involved an attacker impersonating someone an employee trusted, then using that employee’s login to reach customer information on external platforms. BBC reporting on October 8 revealed home addresses, birth dates, customer numbers and shopping searches among the stolen records, while ASOS said passwords and payment card information were not accessed.

Key fact	What you need to know
When it happened	The incident became public on October 6, 2026
How customers found out	An unauthorized app notification linked to Telegram
Data ASOS first confirmed	Names and contact information were initially described as possibly accessed
Extra data BBC found	Postal addresses, birth dates, customer numbers, shopping searches and an account creation date
What was not taken	ASOS said account passwords and payment card information were not accessed
How attackers got in	An employee was impersonated to obtain access through their login
Who claimed it	Xuanye, called Xuanyewen in BBC reporting
Number affected	Undisclosed, with around 17 million customers in ASOS’s total customer base

What happened in the ASOS data breach

You might expect a retailer to tell you about a breach before hearing from the people behind it. Here, the attackers reached customers through the app itself. The following days brought more information, and a longer list of exposed details.

1. October 6, around 10am UK time or 5am ET. Customers received an unauthorized push notification directing them to Telegram. The message threatened publication of customer information.
2. October 6, later that day. ASOS issued a stock exchange announcement about suspicious activity involving external customer communication services. Its shares finished more than 10% lower, and the UK Information Commissioner’s Office said it had not yet heard from ASOS or Snowflake at that point.
3. October 7. The attackers supplied the BBC with sample records. The broadcaster waited until ASOS had contacted customers before publishing its findings.
4. October 8. ASOS emailed customers and explained that an attacker had impersonated a contact an employee trusted. The company said passwords and card information had not been accessed.
5. October 8, later that day. BBC reporting revealed additional personal information in the sample, including birth dates and website searches.
6. October 9. Malwarebytes and Surfshark published updates explaining the exposed information and possible follow-up scams.
7. October 12. Xuanye claimed responsibility for another incident involving Air France-KLM. The airline group confirmed unauthorized access to internal folders and said customers were unaffected.

ASOS first said names, then the list grew

Names and contact information were only part of what the BBC found. If you read the first ASOS announcement, you would not have received the same level of detail about the records involved. Here is how the accounts compared.

What ASOS said Oct 6	What ASOS said Oct 8	What BBC saw in the hackers’ sample
Names and contact information might have been accessed	Some personal information had been accessed, including names and contact information	Names, postal addresses, telephone numbers and email addresses
Birth dates and customer numbers were not specified	These fields were not individually listed in the quoted update	Birth dates and customer numbers
Shopping searches and account creation dates were not specified	Some account information described as non-personal was included	Website searches and one customer’s account creation date
Card information and passwords were believed unaffected	ASOS said neither had been accessed	The BBC report repeated ASOS’s assurance about passwords and bank details

Why should your searches concern you? A scammer could reference a petite clothing search or a wide-fit item to make a message feel familiar. You see, knowing what you browsed does not prove that someone works for ASOS.

How the hackers got in

The explanation starts with an employee account, but the attackers made additional claims about the services involved. Those claims do not all carry the same weight. To understand what happened, separate ASOS’s findings from what the group says it accessed.

One tricked employee

ASOS said the attacker pretended to be a contact an employee trusted. That deception gave the attacker access to the employee’s account, and the login was then used to reach information held on external platforms.

ASOS restricted access to those platforms and brought in internal and outside investigators. For you, the key detail is that the company attributed entry to an employee login, rather than a stolen customer password.

The Snowflake and Simon AI claims

The notification claimed access to ASOS’s Snowflake environment. The group later said it had used Simon AI, a customer personalization service built on Snowflake.

Snowflake said it found no breach of its underlying platform. Access through stolen credentials does not, by itself, establish that the platform was hacked.

There is relevant history here. A separate 2024 campaign involving Snowflake customer accounts affected more than 160 organizations, including Ticketmaster, AT&T and Santander. Investigators linked that campaign to stolen logins on accounts without multifactor authentication, but that does not establish the same circumstances at ASOS.

Who is behind Xuanye

The claim appeared through a newly created Telegram channel under the Xuanye name. BBC reporting used the variant Xuanyewen.

BBC Verify identified language traits consistent with Chinese, but those clues do not establish the attackers’ identity or location. Security commentary also raised the possibility of deliberate misdirection.

The later Air France-KLM claim adds another incident to the group’s public statements. It does not resolve who operates the group.

The ransom demand and the clock

The attackers reportedly wanted payment in return for deleting the stolen information, with publication threatened otherwise. If you are watching the dates, one distinction matters. The reported window concerned making contact, rather than a confirmed publication deadline.

According to The Telegraph’s reporting, carried by AOL, the group gave ASOS two weeks to establish contact. Counting from October 6 puts that window around October 20. No ransom amount was reported.

On October 12, Xuanye said it would leave the ASOS records untouched for a limited period. ASOS had not disclosed whether it would pay, so you should treat any claimed deadline as the attackers’ reported demand.

Are US ASOS shoppers affected

Living in the US does not give you a confirmed exemption from this incident. ASOS serves roughly 17 million customers across more than 150 markets, but it has not published a country breakdown of affected accounts. Here is what you can establish from the available reporting.

• October’s US impact remains unclear. Early notification reports identified customers in the UK and Australia. That does not establish that those were the only countries involved.
• Missing the notification does not clear your account. The UK NCSC advised ASOS customers to assume involvement even without receiving the alert. With no geographic breakdown, US shoppers have reason to take the same precaution.
• The summer incident was separate. ASOS US Sales LLC filed a notice with California’s attorney general concerning credential stuffing detected in July 2026. Srourian Law Firm put that incident’s affected population at approximately 138,828.
• The exposed records differed. The July incident included limited card information, such as the final four digits and expiry date, without full card numbers or security codes. Those findings should not be transferred to October’s breach, for which ASOS said card information was not accessed.

What to do now if you shop at ASOS

ASOS says you do not need to change anything on your account because of this incident. Even so, you can take precautions against messages that misuse your information. Start with these checks.

1. Ignore the hacked notification. Leave its Telegram link alone, and avoid links in unexpected follow-up messages. The NCSC warns that scam attempts can arrive well after the breach itself.
2. Open ASOS yourself. Use the official app or go directly to the website when checking your account. The retailer’s name alone does not prove authenticity.
3. Replace reused passwords. If your ASOS password is shared with another account, change it through the official site or app. That is a precaution, not evidence of a stolen password.
4. Add stronger login protection where available. Use a passkey or a separate, strong password with two-step verification on accounts that support these options. The NCSC recommends these measures.
5. Check your account and statements. Review saved addresses and orders, then watch bank and card statements for unfamiliar activity. ASOS says card information was not accessed, so these are precautionary checks.
6. Use US reporting and credit tools if needed. Report scams through ReportFraud.ftc.gov and identity theft through IdentityTheft.gov, which provides a free recovery plan. A free initial fraud alert lasts one year, and you request it from one credit bureau, which informs the other two. For a credit freeze, contact Equifax, Experian and TransUnion separately – placing and lifting it costs nothing.

Scam messages to expect after the breach

What if a message knows your birthday and what you searched for last week? That can make it convincing, but Malwarebytes warns that accurate personal details do not prove a message came from ASOS. Watch for these warning signs.

• Refund or compensation offers. An unexpected message may promise money because of the breach. Surfshark warns about compensation scams, so check with ASOS directly.
• Account verification requests. A link may lead to a fake login or password-reset page. Illumio’s Trevor Dearing warns against unexpected password requests, given ASOS’s assurance that passwords were not taken.
• Delivery problem messages. A supposed issue with your parcel may give someone a reason to request payment details. ASOS says it will never request those details through an unexpected message or call.
• Calls requesting security codes. A caller might use your real name to sound credible before asking for a one-time code. ASOS’s warning covers security codes as well as passwords and payment information.
• References to your shopping searches or birthday. Personal details in the BBC sample could make a scam feel relevant to you. You see, familiarity is not proof of identity.
• Threats to close your account within 24 hours. Dearing warns that scammers may use this kind of deadline to pressure you. Check your account through the official app or website instead of following the message’s instructions.

Is it still safe to shop on ASOS

ASOS says its website and app remained safe during the incident. That is the company’s position, and you should read it alongside its ongoing investigation. Here is what it means for your next visit.

The company says it locked down the external platforms involved and added security controls. Internal teams and outside experts are investigating, with law enforcement and regulators involved too. The investigation still has questions to answer.

If you continue shopping, open ASOS directly and keep unexpected messages separate from that visit. A functioning store does not establish that a refund text or payment request is genuine. Check its origin, even when you recognize the details.

Why the ASOS response drew criticism

You need enough information to understand what a breach means for you. Criticism of ASOS centered on the time taken to respond and the limited detail in its early announcement. Those two concerns explain the reaction.

According to the Independent, as cited by Malwarebytes, roughly five hours passed between the unauthorized notification and ASOS’s full statement. During that gap, customers had already received an alarming message through the retailer’s own app. The attackers had spoken before customers received a full explanation.

The early description mentioned names and contact information, while the BBC later identified more detailed records. Security researcher Kevin Beaumont criticized the company’s openness and compared its communication problems with those seen at Co-op and M&S. That comparison concerned communication, rather than identical attacks.

The ICO said on October 6 that neither ASOS nor Snowflake had contacted it at that point. ASOS later said it was working with relevant regulators and law enforcement. Keep those dates in mind.

What to watch next

You may want a final answer now, but ASOS’s investigation is expected to take several weeks. Its findings should answer unresolved questions. Keep an eye on these developments.

• The reported contact window. ASOS reportedly had around two weeks to get in touch with the attackers, putting the cutoff near October 20. That date does not confirm when any stolen records would be published.
• Any release of customer records. Xuanye has threatened publication and later claimed it would hold the records untouched for a limited time. Treat that assurance as an attacker’s claim.
• Regulatory updates. Watch for statements from the ICO or ASOS about regulatory involvement. The October 6 comment describes what the ICO knew then.
• Direct customer contact. ASOS says it will contact customers if further action becomes necessary. Check any request through the official site or app.
• Investigation findings and trading effects. ASOS initially said it was too early to calculate the business impact. Updates may clarify that and the incident’s scale.
• Further Xuanye claims. The group reportedly claimed the Air France-KLM incident too. No connection between ASOS and the separate H&M claims has been confirmed.

FAQs