ASOS Confirms Data Access
ASOS confirms that an intruder impersonated a trusted contact, obtained an employee’s login credentials and accessed third-party platforms. The exposed information included names, contact details and certain non-personal account information. An unsolicited push notification reached some customers on 6 October.
The retailer says payment-card information and account passwords were not accessed. It restricted access to the affected platforms and says its website and app remained safe to use. The investigation continues; ASOS will contact customers directly if further information, support or action is needed.
Do not wait for an alert
The National Cyber Security Centre advises every ASOS customer to assume they could be affected, even without a notification. Open the retailer’s website or app independently rather than following a suspicious message. Scam messages may arrive later.
The NCSC also recommends reviewing account activity and using passkeys or strong, separate passwords with two-step verification. This is protective advice, not evidence of stolen ASOS passwords. ASOS is not asking customers to reset their account password.
A familiar channel is not proof
BlackTree’s Trezor and Brevo analysis explains how a genuine communications channel can carry a hostile message. That is context, not evidence of a shared supplier, attacker or technique.
The remaining unknowns
The public notices do not name the affected platforms or attacker, give a customer count or provide a complete inventory of accessed information. Do not mistake those unanswered questions for evidence that no access occurred.
Sources checked 19 October 2026: ASOS’s undated notice; NCSC alert, 6 October; and BlackTree analysis, 11 September, updated 21 September. The ASOS notice was already linked in this article’s 10 October update; that is not its confirmed publication date.
