ASOS Says Customer Data Was Exposed. Watch for Phishing
Matthew Leo · Published October 9, 2026 · Guides
ASOS says an attacker impersonated a trusted contact, obtained an employee’s login credentials and used them to reach information on third-party platforms. The retailer’s initial investigation found that some customer names and contact details were accessed, along with certain non-personal account information.
ASOS told customers that payment-card information and account passwords were not affected. Its website and app remained available, and the affected platforms were locked down. Those statements narrow the immediate risk, but exposed contact details can make the next phishing message more convincing.
What ASOS has confirmed
The incident became visible on October 6, when some customers received an unauthorized push notification through the ASOS app. The company’s customer notice says users should disregard that notification and avoid its external link.
On October 8, ASOS provided more detail in an email to customers, reported by Reuters. The company said the attacker impersonated a trusted contact to get an employee’s credentials, then used the account to access third-party services.
ASOS has not publicly established that every customer was affected, nor has it confirmed every record accessed. It is working with law enforcement, regulators and outside specialists. Claims made by people purporting to be the attackers should not be treated as verified unless ASOS or investigators confirm them.
Why names and contact details still matter
A fraudster who knows that someone shops at ASOS may be able to write a more credible message about a delayed order, refund, customs charge or account review. A real name, email address or phone number can make that lure feel routine.
The exposed information does not let someone charge a card by itself. It can, however, provide the context needed to persuade a shopper to disclose a password, one-time code or payment details on a fake page.
Canadian customers should be especially cautious with messages about import fees or parcel delivery. A legitimate-looking order theme can be paired with a Canadian carrier name or a fake customs payment request even when the sender has no access to the real shipment.
What Canadian ASOS customers should do
- Open ASOS directly. Use the saved app or type the address yourself instead of following a link in an email, text or push notification.
- Check orders inside your account. A message about a refund, delivery problem or payment failure should match information visible after a direct sign-in.
- Do not share one-time codes. Customer support should not need a code that authorizes a login or payment.
- Review your email account security. Turn on multifactor authentication and check recent sign-ins. The email account is often the recovery route for a shopping account.
- Change reused passwords. ASOS says account passwords were not affected, so a blanket reset is not required on the facts now available. If the same password is used elsewhere, replace it with a unique one anyway.
- Watch card statements without cancelling automatically. ASOS says card data was not exposed. Monitor for unfamiliar charges and contact the card issuer if one appears.
How to handle a suspicious message
Stop the interaction and verify it through a separate channel. Do not call a number or use a support link supplied in the suspicious message. The Canadian Anti-Fraud Centre recommends checking claims through trusted contact details and reporting fraud or cybercrime.
If you entered a password on a page reached from the unauthorized October 6 notification, change that password immediately anywhere it was reused. Sign out other sessions where the service allows it, review the associated email account and contact the payment provider if financial information was submitted.
The useful distinction is between what is confirmed and what is possible. ASOS has confirmed access to names, contact details and some non-personal account information, but not passwords or payment cards. The most credible near-term risk is therefore targeted phishing, not evidence that every customer’s financial account has been compromised.
Tags: ASOS, data breach, social engineering, phishing, customer data