ASOS customer information was taken after an employee’s login credentials were obtained through impersonation, according to a newer company notice reported by the BBC on October 8. The BBC’s examination of a sample found richer profiles than the possible contact-data exposure described in ASOS’s October 6 regulatory statement. ASOS says bank details and passwords were not accessed. [3]
October 8: the stolen records go beyond a contact list
The BBC reported names, addresses, telephone numbers, email addresses, customer numbers, dates of birth and shopping searches. It also saw a customer’s joining date. These fields describe a relationship with the shop, not just a way to contact someone. The company did not answer the BBC’s question about the scale of the breach, so no confirmed victim count follows from the sample.
ASOS told customers that an attacker impersonated a trusted contact to obtain an employee’s login credentials. The resulting access to an unnamed service allowed customer data to be downloaded. That account explains the credential-acquisition step; it does not establish a vulnerability in the retailer’s app or a compromise of every connected database. [3]
The criminals named Simon AI, a platform built on Snowflake, when speaking to the BBC. That is their claim. Snowflake said its platform had not been breached, and the BBC had contacted Simon AI for comment. The evidence should not be converted into a confirmed platform flaw.
October 6: a real notification channel carried an unauthorised message
The incident first became visible through the ASOS app. The company confirmed that an unauthorised notification reached customers at around 10am on October 6. Its regulatory statement described activity involving external customer-communication platforms, restricted access to the notification platforms and an investigation with internal and external specialists. At that point it described possible access to names and contact details and said it did not believe passwords or payment-card information were impacted. [1]
The later customer notice changes the data-exposure account, while the original notification remains a separate observation. Ability to send a message is not proof of access to every system. Conversely, a working shopping app cannot show that information was never copied elsewhere.
A convincing customer detail is not proof of identity
A follow-up message could know your name and refer to products you searched for. That would make the message feel personal, but would not establish that the sender works for ASOS. The risk is impersonation built from a real customer profile; the report does not establish a particular follow-up phishing campaign.
The UK’s National Cyber Security Centre (NCSC) told ASOS customers on October 6 to treat themselves as potentially affected even without receiving the notification. This is precautionary guidance, not a finding that every customer’s records were copied. [2]
Open ASOS independently when checking an account or contacting support. Ignore suspicious notification, email or text links, and do not share passwords, security codes or payment details through an unsolicited call or message. The company says its website and app are safe to use; that assurance does not authenticate a message arriving from elsewhere.
The Manchester Airport breach response explains the related decision: knowledge of a real customer relationship does not make a new payment request legitimate.
ASOS’s story now includes copied customer profiles, not only a rogue notification. Keep the dated findings distinct and verify the sender independently when an unexpected message appears to know your shopping history.
References
- ASOS plc. “Update regarding cyber incident.” RNS 8604X, October 6, 2026. Regulatory statement.
- National Cyber Security Centre. “Incident affecting ASOS customers.” October 6, 2026; accessed October 9, 2026. Customer guidance.
- Joe Tidy. “Asos hackers took more personal details than first revealed, BBC finds.” BBC News, October 8, 2026. Sample examination and customer notice.
