What to do now: If you got the “ASOS HACKED” notification, delete it and do not tap the Telegram link inside. ASOS now says hackers hold detailed profiles of potentially millions of users: names, addresses, phone numbers, emails, customer numbers, dates of birth, and on-site search history. Assume you are affected. The practical risk is targeted scam calls and impersonation messages, not just generic phishing emails. ASOS itself warns customers to “remain cautious of unexpected messages or calls claiming to be from Asos,” and says it will never ask for passwords, security codes, or payment details through unsolicited contact. ASOS says bank details and passwords were not accessed, so there is no need to cancel your card over this. Change your ASOS password if you reuse it elsewhere, and turn on two-step verification where available.
On the morning of October 6, 2026, thousands of ASOS app users woke up to a push notification that read “ASOS HACKED.” It was not a promotion gone wrong. Attackers had broken into a third-party platform ASOS uses to message customers and used it to broadcast an extortion note straight to people’s lock screens, before ASOS had said a word publicly. Since then the story has grown: what ASOS first called “basic contact details” turned out to be detailed profiles of potentially millions of users. Here is what the attackers claimed, what ASOS has actually confirmed, and where the two stories split.
Read Also: Oracle Health Breach: 20 Million Records and What to Do Now
What the notification said
The alert started landing around 5:00 a.m. ET on Tuesday, October 6, according to BleepingComputer’s reporting. Users in Great Britain, Ireland, the US, and several other countries got it. The message read:
“ASOS HACKED. Dear Asos DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.”
It was signed “xuanyewengateway” and linked to a Telegram channel run by a group calling itself the Xuanye Group. The channel was created on October 6 itself, and the account behind it previously used names tied to gaming-item trading, according to Group-IB’s threat research. That points to a brand-new operation, not an established crew.
Notice who the message is addressed to. It is not written for shoppers at all. It speaks to ASOS’s data protection officer and IT team, which reads like a ransom note sent through the loudest channel the attackers could find. Customers were just the delivery mechanism. Sending it this way guarantees the company cannot quietly ignore the demand, because thousands of people and the press see it at the same time.
Claimed vs confirmed
This is where most coverage gets sloppy, so here is the split as of October 11:
- Attackers claimed (Oct 6): full compromise of ASOS’s Snowflake data warehouse, with a leak threat attached.
- Attackers claimed (to the BBC, Oct 8-9): they breached Simon AI, a marketing platform built on Snowflake, to get the data. They also sent the BBC a sample they say includes names, addresses, phone numbers, emails, customer numbers, dates of birth, and search history. Note the attribution carefully: the BBC reported receiving the sample but did not say cybersecurity experts had verified it.
- ASOS confirmed (updated disclosure): after the BBC approached the retailer about the sample, ASOS told customers that hackers hold detailed profiles of potentially millions of users: names, addresses, phone numbers, emails, customer numbers, dates of birth, and on-site search history. No bank details or passwords were accessed.
- Snowflake said: its investigation “found no compromise of the Snowflake platform,” and the incident “did not in any way result from a vulnerability, weakness, flaw, or misconfiguration” of its service.
- Root cause (ASOS to BleepingComputer, Oct 8): a social engineering attack. Someone impersonated a trusted contact to steal an employee’s login credentials, then used them against third-party platforms. What is confirmed is the entry point. The exact platform the data came from is still the attackers’ claim, so treat the Simon AI route as alleged, not established.
The market reacted before any of that was clear. ASOS shares on the London Stock Exchange fell more than 10 percent within hours of the notification going out, and Downdetector logged hundreds of user reports in the first hour. Dozens of people told the BBC they received the message. Some thought it was a promotion. Others said it left them scared to open the app.
Why this one is different
Most breaches surface through a company statement or a leak-site post. This one landed on customers’ lock screens first. That inversion is the story. The attackers did not need to prove they had data. The notification itself was the weapon: it created panic, tanked the share price, and forced ASOS to respond in public on the attackers’ timeline.
It also exposes an uncomfortable truth about modern retail apps. Your phone trusts a push notification from a brand’s own app implicitly. There is no spam filter for it, no suspicious-sender warning. Whoever controls the messaging platform controls a direct line to every customer’s lock screen, and this week that line had no kill switch fast enough.
What to watch for next
The confirmed exposure is far wider than “basic contact details”: full names, home addresses, phone numbers, email addresses, customer numbers, dates of birth, and search history. That combination enables targeted scam calls. Someone who knows your name, your address, your date of birth, and that you searched for “ASOS petite” last week can sound very convincing on the phone. ASOS’s own guidance now says to stay cautious of unexpected messages or calls claiming to be from ASOS. Take that seriously. A caller who knows your order history is not automatically legitimate.
One more thing worth knowing. This was not ASOS’s first incident this year. In July, attackers used passwords stolen from outside ASOS to log in to customer accounts in a credential-stuffing attack. ASOS disclosed it on August 21, and the count stood at 138,828 US customers. The company said only redacted card details, the last four digits and expiry date, were exposed there, with no full card numbers. Nothing links the two incidents so far, but together they put ASOS account security under a harsh light.
ASOS hack questions, answered
Was my payment card stolen in the ASOS hack?
According to ASOS, no. The company says bank details and account passwords were not accessed in the October incident. The exposed data is personal and account-related: names, addresses, phone numbers, emails, customer numbers, dates of birth, and search history. If that changes, this article will be updated.
Should I delete the ASOS app?
No need. ASOS moved quickly to lock down the affected platforms, and there has been no reported impact on orders. Deleting the app does not protect data that may already have been accessed, and reinstalling later changes nothing. The useful moves are the boring ones: a unique password, two-step verification where available, and skepticism toward any unsolicited message or call claiming to be from ASOS.
Has ASOS been hacked before?
Yes. In July 2026, attackers used credentials stolen from outside ASOS to log in to customer accounts, a credential-stuffing attack the company disclosed on August 21. It affected 138,828 US customers, with only redacted card details exposed, according to the company’s notification. The October push-notification incident is a different attack with a different vector: stolen employee credentials used against third-party platforms, per ASOS’s October 8 update to BleepingComputer.
Correction (October 11, 2026): An earlier version of this article understated the scope of the breach, describing the confirmed exposure as names and contact details and calling it “phishing fuel, not identity-theft fuel.” ASOS has since confirmed that hackers obtained detailed profiles of potentially millions of users, including addresses, phone numbers, dates of birth, customer numbers, and search history. The advice section has been updated to reflect the higher risk of targeted scam calls. We also corrected the claim that no data warehouse was breached: the exact source of the stolen data remains the attackers’ claim (Simon AI, per their statements to the BBC), while what ASOS confirmed is the social-engineering entry point.
