As an avid ASOS user myself, I was intrigued when this story first appeared in my LinkedIn newsfeed last week.
I've looked into what's been confirmed so far, what's still unclear, and the key lessons I believe UK businesses can take from the incident.
Keep posted for more #CybersecurityAwarenessMonth content from Netitude this October!
Last updated: 13 October 2026
As an ASOS customer myself, I was caught off guard by the recent cyber incident when reports began appearing in my LinkedIn feed. But beyond the headlines, it offers a useful reminder for every organisation: cybersecurity risks don't always start with a sophisticated technical exploit. Sometimes, all it takes is a convincing message and access to the wrong account.
The incident saw ASOS customers receive an unauthorised push notification claiming the retailer had been hacked. ASOS subsequently confirmed that an attacker had impersonated a trusted contact to obtain an employee's login credentials and use them to access information on certain third-party platforms.
So, what actually happened, what information may have been accessed, and what can UK businesses learn from it?
On 6 October 2026, some ASOS customers received an unexpected push notification with the message “ASOS HACKED” and a link directing them to Telegram.
The notification raised immediate concerns about a potential data breach. Early reports included claims by the individuals behind the incident that a Snowflake environment had been compromised. However, claims made by an alleged attacker should not be treated as confirmed facts.
ASOS's subsequent investigation identified a different, more specific route into its systems: an unauthorised party impersonated a trusted contact to obtain an employee's login credentials. Those credentials were then used to access information on certain third-party platforms used by ASOS.
The affected platforms were locked down, and ASOS began investigating with internal and external cybersecurity specialists, alongside the relevant authorities.
According to ASOS's customer update:
The investigation is ongoing, so the full picture may develop as further information becomes available.
Sources: ASOS's official customer update | Reuters' report on the incident
6 October 2026 — Unauthorised notification sent
Some customers received an unexpected push notification claiming ASOS had been hacked. The message included a link to a Telegram channel. ASOS confirmed that an unauthorised notification had been sent and that it was investigating activity involving third-party platforms used to communicate with customers.
6 October: Access restricted
ASOS said it had taken immediate action to restrict access to the affected notification platforms and was working with specialist advisers and relevant authorities.
7 October: Regulatory warning
The UK's Information Commissioner's Office (ICO) urged people to remain alert to suspicious messages and avoid clicking unexpected links or sharing personal or financial information in response to unsolicited contact.
8 October: ASOS explains how access was obtained
ASOS published a further update explaining that an attacker had impersonated a trusted contact to obtain an employee's login credentials. Those credentials were then used to access information on certain third-party platforms. ASOS also confirmed that some customer personal information had been accessed, while payment card information and account passwords had not.
13 October: Investigation continues
ASOS's customer update states that its investigation will continue over the coming weeks. The information available should therefore be treated as the current picture, rather than a final account of everything that happened.
Cyber incidents can quickly generate speculation, particularly when alleged attackers publish their own claims. For businesses assessing the risk, it's important to separate confirmed information from assumptions.
| Confirmed by ASOS | Claims or details that require caution |
|---|---|
| An attacker impersonated a trusted contact to obtain an employee's login credentials. | Initial claims about the precise systems compromised should not be accepted without corroboration. |
| The credentials were used to access information on certain third-party platforms. | The full scope of the incident may change as the investigation continues. |
| Some customer personal information and certain non-personal account-related information were accessed. | Any claim about the total volume or exact range of data should be attributed to a reliable source. |
| ASOS says payment card information and account passwords were not accessed. | The absence of exposed passwords or card data does not mean the incident carries no risk for customers. |
The distinction matters. Repeating unverified claims can create unnecessary alarm and distract from the lessons that are already clear.
The unauthorised push notification was one of the most visible parts of the incident. It also illustrates how a cyber attack can affect customer-facing systems without necessarily making a company's main website or app unusable.
ASOS says the attacker obtained an employee's credentials through impersonation and then accessed certain third-party platforms used by the business. This is a reminder that organisations rely on more than their core IT infrastructure: customer communications, marketing platforms, cloud services and other suppliers may also hold access to sensitive systems or information.
A third-party service can become part of an organisation's attack surface if access isn't properly controlled. That doesn't mean every supplier is inherently unsafe; it means the security of connected services and the accounts that access them needs to be managed carefully.
For businesses, the key questions include:
These questions are relevant to organisations of every size, not just major online retailers.
It's tempting to view a high-profile retail breach as a problem for a large organisation with a complex technology estate. In reality, several of the underlying risks are common across small and medium-sized businesses.
Social engineering involves manipulating people into revealing information or taking actions that help an attacker. Impersonation is one example: someone may pose as a colleague, supplier, senior manager or trusted contact to make a request appear legitimate.
The ASOS incident highlights the importance of verifying unusual requests, especially those involving login credentials, changes to account access or urgent actions. A message that appears to come from someone familiar should not automatically be trusted.
What to do: Establish a clear process for verifying unexpected requests through a separate, trusted channel. Staff should know that it's acceptable to pause and check, even when a request appears urgent or comes from a senior person.
A username and password alone can be insufficient if an attacker persuades someone to disclose their credentials. Multi-factor authentication (MFA) adds another layer of verification when a user signs in.
MFA should be enabled wherever available, particularly for email, administrator accounts, remote access and platforms that contain customer information or can send communications on the organisation's behalf.
What to do: Review where MFA is enabled, prioritise accounts with elevated permissions and remove accounts or access rights that are no longer needed. MFA is an important safeguard, but it should sit alongside other controls rather than being treated as a complete solution on its own.
Businesses often use a wide range of external services for customer relationship management, marketing, file sharing, finance and IT management. Each service can introduce additional access points that need to be secured.
If an employee account is compromised, the potential impact depends partly on what that account can access.
What to do: Maintain an inventory of business platforms, identify who owns each service, review permissions regularly and remove unnecessary access. Pay particular attention to accounts that can export data, change settings, or send messages to customers.
Preventive controls are essential, but no organisation can assume that every attack will be stopped before access is gained. Detecting suspicious behaviour quickly can help limit the impact.
Unexpected logins, unusual locations, changes to account permissions and unfamiliar activity within third-party platforms may all warrant investigation.
What to do: Ensure important systems have appropriate logging and alerting, and designate who is responsible for reviewing them. Where internal resources are limited, consider whether specialist monitoring and support could close the gaps.
When a breach occurs, teams need to know what to do, who makes decisions, and how to secure systems or accounts. Confusion and delays can make a difficult situation worse.
An effective response plan should cover technical containment, communication with affected people, evidence preservation, escalation to specialist support and any regulatory obligations.
What to do: Test the plan before an incident happens. A tabletop exercise — walking through a realistic scenario with the relevant people — can help expose gaps in responsibilities, decision-making and communication.
Under UK GDPR, organisations must report certain personal data breaches to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of them. This applies where the breach is likely to result in a risk to people's rights and freedoms; not every personal data breach is automatically reportable. Organisations should document breaches and assess their reporting obligations appropriately.
For further information, consult the ICO's guide to personal data breaches.
ASOS says no payment card information or account passwords were accessed, and that its website and app remained safe to use. It also advises customers to be cautious of unexpected messages or calls claiming to be from ASOS.
The National Cyber Security Centre (NCSC) has advised people to watch for suspicious messages that may follow a breach, avoid clicking unexpected links and use strong, unique passwords with two-step verification.
Practical steps include:
The NCSC's guidance for people affected by the ASOS incident provides further advice.
Was ASOS hacked?
ASOS confirmed that an unauthorised party gained access to an employee account by impersonating a trusted contact to obtain login credentials. Those credentials were then used to access information on certain third-party platforms.
What information was accessed in the ASOS data breach?
ASOS says that some personal information, including names and contact details, and certain non-personal account-related information, was accessed. The investigation is ongoing, so the full scope may become clearer as further updates are released.
Were ASOS passwords or payment card details stolen?
ASOS says its investigation found that no account passwords or payment card information were accessed.
Is it safe to use the ASOS website and app?
ASOS says its website and app were safe to use throughout the incident and remain so. Customers should still remain alert to unexpected communications claiming to be from the retailer.
What can businesses learn from the ASOS cyber attack?
The incident highlights the importance of defending against social engineering, protecting employee accounts with MFA, reviewing third-party access, monitoring unusual activity and preparing an incident response plan.
Does every data breach need to be reported to the ICO within 72 hours?
No. Under the UK GDPR, the 72-hour reporting requirement applies to personal data breaches that are likely to pose a risk to people's rights and freedoms, where feasible. Organisations must assess the circumstances, document breaches and determine whether reporting is required.
The ASOS incident is a reminder that cyber risk doesn't stop at the firewall. A convincing impersonation, a compromised employee account or poorly controlled access to a third-party service can create consequences well beyond the original point of entry.
For UK businesses, the lesson isn't simply to buy more security technology. It's to understand which systems matter, who can access them, how suspicious activity will be identified and what happens if something goes wrong.
At Netitude, we help businesses take a practical approach to IT and cybersecurity - from strengthening everyday security controls to reviewing how risks are managed across their wider environment.
Is your business ready for a social engineering attack?
October is Cyber Security Awareness Month, and the ASOS incident is a timely reminder that your people are part of your security. If you'd like to know how your business would hold up, read our guide to the main cyber threats facing UK businesses in 2026 and why cyber security training matters more than ever, or talk to our team about a security review.
Thanks for reading. Incidents like this are a reminder that cybersecurity isn't just a technology problem. It's about people, everyday habits and having the right safeguards in place when something goes wrong.
If this story has raised questions about your own business's security, I'd be happy to put you in touch with our team at Netitude to discuss how you can strengthen your defences.