ASOS hacked? The retailer is investigating a cybersecurity incident after some customers received an unexpected push notification on October 6, 2026. The message was sent without authorisation through third-party platforms used for customer communications.
The incident has raised concerns about customer privacy and whether personal information was exposed. ASOS says names and contact details may have been accessed, while payment-card information and account passwords are not believed to have been affected.
What Happened at ASOS?
Some customers received an unusual push notification that was not part of ASOS’s planned communications.
The company identified unauthorised activity involving third-party platforms and took steps to restrict access. It has since launched an investigation with specialist teams and relevant authorities.
Customers who received the notification have been advised not to interact with the external link included in the message.
Was ASOS Hacked?
ASOS has confirmed a cyber incident involving unauthorised activity, but the investigation is still ongoing.
That means it is too early to say that the retailer’s entire system was compromised. The available information points to unauthorised activity involving platforms used to communicate with customers.
ASOS has said that some basic customer information may have been accessed. More details could become available as the investigation progresses.
What Customer Information May Be Affected?
The information potentially accessed includes customer names and contact details.
While these details are not the same as passwords or payment information, they can still be useful to criminals. Names and contact details can be used to make phishing emails, texts or other scam messages look more convincing.
ASOS currently says it does not believe payment-card information or account passwords were affected.
Are ASOS Passwords Safe?
Based on the information released by the company, customer passwords are not believed to have been affected.
Customers should still be cautious if they receive unexpected password-reset emails or messages. A genuine-looking notification can sometimes be used to trick people into visiting a fake login page.
The safest approach is to open the ASOS website or app directly instead of using links in unexpected messages.
Were Bank and Card Details Exposed?
ASOS says it does not believe payment-card information was affected by the incident.
Customers should therefore not assume that their card details have been stolen simply because of the security issue.
However, anyone receiving an unexpected payment-related message should treat it with caution. Do not provide card details or banking information through a link received in an unsolicited message.
What Should ASOS Customers Do?
Customers should remain alert to unusual emails, text messages and push notifications that appear to be connected with ASOS.
If you receive something suspicious, do not click the link or provide personal information. Instead, access your account directly through the official website or app.
It is also worth paying attention to unexpected password-reset requests, account warnings or messages asking you to confirm personal details.
What If You Clicked the Suspicious Link?
If you already clicked the link, there is no need to panic.
What you should do next depends on whether you entered any information. Simply opening a webpage is different from entering a password or payment details.
If you submitted sensitive information, take steps to secure the relevant account and remain particularly careful about further messages claiming to be from ASOS.
Is the ASOS Website Still Working?
Yes. The company’s website and app remain available.
ASOS has restricted access to the platforms connected with the unauthorised activity while its investigation continues.
The incident has therefore not resulted in the entire shopping service being taken offline.
Customers can continue using the service, but they should be careful with communications related to the security incident.
What Does the NCSC Say?
The UK’s National Cyber Security Centre has issued guidance following the incident.
The NCSC is advising ASOS customers to assume they may be affected, even if they did not receive the unusual notification.
It is also encouraging customers to be alert to suspicious messages and potential scams.
This advice matters because criminals may try to take advantage of the publicity surrounding a security incident by sending fake messages to customers.
Could There Be Follow-Up Scams?
Customers should be particularly careful over the coming days.
Scammers could potentially use the incident as a reason to contact people. A fake message might claim that an ASOS account has been locked, a payment needs to be verified or a password needs to be reset.
These messages can look convincing because they refer to a real security story.
Never assume a message is genuine simply because it contains the company’s name or branding.
Why This Incident Matters
The situation highlights the security risks associated with third-party services.
Major retailers use external platforms for many parts of their customer communications. A security problem involving one of those services does not automatically mean that the retailer’s main website, payment systems or entire network has been compromised.
For customers, however, an unauthorised notification can still create a serious security concern.
What We Know So Far
The investigation is still developing.
ASOS has confirmed that some customers received an unauthorised push notification and that unauthorised activity involving third-party communication platforms was identified.
Names and contact details may have been accessed. The company does not currently believe that payment-card information or account passwords were affected.
The retailer has restricted access to the relevant platforms and is continuing its investigation.
The NCSC has also issued guidance encouraging customers to remain cautious.
What Happens Next?
ASOS is expected to provide further information as its investigation continues.
More details could clarify how the unauthorised activity occurred, how many customers were affected and exactly what information was accessed.
For now, customers should avoid suspicious links and access their accounts directly through the official ASOS website or app.
The most important thing is not to panic. The current information does not indicate that customer passwords or payment-card information were compromised, although the investigation remains ongoing.
FAQs
Was ASOS hacked in 2026?
ASOS has confirmed a cybersecurity incident involving unauthorised activity and is investigating what happened. It has not confirmed that its entire platform was compromised.
What happened to ASOS customers?
Some customers received an unauthorised push notification. The company says names and contact details may have been accessed.
Were ASOS passwords stolen?
ASOS says it does not believe customer account passwords were affected.
Were ASOS card details exposed?
The company says it does not believe payment-card information was affected.
Should I change my ASOS password?
ASOS has not instructed customers to change their passwords because of the incident. Customers should still be cautious about unexpected password-reset messages.
What should I do if I receive a suspicious ASOS message?
Do not click unfamiliar links or provide personal information. Open the official ASOS website or app directly to check your account.
Final Takeaway
The ASOS security incident is still being investigated, so some details may change as more information becomes available. For now, customers should avoid suspicious links and messages, while ASOS says payment-card information and account passwords are not believed to have been affected. Anyone concerned about their account should access ASOS directly through its official website or app and stay alert for unusual activity.
