ASOS data breach: customer names, addresses and birth dates

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

ASOS, the UK online fashion retailer, has confirmed a breach of customer data after attackers sent a push notification to ASOS app users on October 6, 2026. ASOS says payment card details and customer passwords were not accessed. Reporting based on a sample the attackers shared indicates that names, home addresses, phone numbers, email addresses and dates of birth were taken.

What happened

ASOS says an attacker tricked an employee into handing over login credentials and used that access to reach customer data (Confirmed, as reported by TechCrunch and Malwarebytes). Customers learned of the incident when an unauthorized notification appeared in the ASOS app. That notification named Snowflake, a cloud data platform, as part of the attack (Claimed). ASOS has not said how many customers are affected.

This is separate from an August 2026 incident at ASOS US Sales LLC, in which customer accounts were accessed using credentials obtained outside the company.

What data was involved

• Payment card details and passwords: not accessed, according to ASOS (Confirmed)
• Names, home addresses, phone numbers, email addresses, customer numbers and dates of birth: Reported by the BBC, based on a sample the attackers shared
• Records of customers' searches on the ASOS site: Reported, same sample

Your name, home address, phone number and date of birth are the core fields of a people-search profile. Paired with shopping history, they can make a fake delivery or refund message look convincing.

What you can do now

1. Be cautious with ASOS-themed messages. Expect emails, texts and app notifications about orders, refunds or account problems. Open the ASOS app or website yourself rather than following a link.
2. Do not act on unexpected push notifications. The attackers already sent one notification through the app. If a notification asks you to log in, pay or confirm details, ignore it and check your account directly.
3. Change reused passwords. ASOS says passwords were not accessed, but if you use your ASOS password anywhere else, now is a good time to change it and turn on two-step verification.
4. Check your credit file. You can view your credit report with Experian, Equifax and TransUnion in the UK and look for applications you do not recognize.
5. Report phishing. Forward suspicious emails to report@phishing.gov.uk, the UK National Cyber Security Centre's reporting service, and suspicious texts to 7726.