ASOS customers in the UK should treat the October cyber incident as a real data-exposure risk even if they did not receive the unauthorised push notification. The UK National Cyber Security Centre says ASOS has reported that names and contact details may have been accessed, while the company does not believe payment-card information or account passwords were affected.
The practical risk is not only what happened inside ASOS. Names, email addresses, phone numbers and other contact information can make later phishing messages look convincing. A scammer who knows where you shop can create a message that feels more believable than random spam.
What happened to ASOS?
On 6 October 2026 some customers received an unauthorised push notification through the ASOS app. ASOS then investigated unauthorised activity affecting its systems. The NCSC has publicly confirmed that it is supporting the response and advises ASOS customers to assume they may be affected.
That wording matters. You do not need to have seen the suspicious notification before taking sensible precautions. Follow-up fraud attempts can arrive later rather than immediately.
What customer data may have been accessed?
According to the NCSC, ASOS has said that basic personal information including customer names and contact details may have been accessed. ASOS has said it does not believe payment-card information or account passwords were impacted.
That is reassuring, but contact information can still be useful for phishing or social-engineering attempts, especially when a message refers to a retailer the recipient actually uses.
Do you need to change your ASOS password?
There is no official statement that ASOS passwords were taken. Changing a password can still be sensible if you reused the same password on other websites, if it is weak, or if you see unusual account activity.
Use a unique password for every important account. If a service supports passkeys or two-step verification, enable them. Do not reuse an ASOS password for email, banking, cloud storage or social media.
What should you do right now?
- Open ASOS directly from the official app or by typing the site address yourself rather than following a message link.
- Check recent orders, saved addresses and account activity for anything you do not recognise.
- Be suspicious of messages claiming you must urgently verify your ASOS account, refund or delivery.
- Do not share one-time passcodes with anyone who contacts you.
- If you reused your password elsewhere, replace those duplicated passwords with unique ones.
- Keep an eye on email and text messages over the coming weeks, not only today.
Could scammers use the incident for fake refunds?
Yes. A common follow-up pattern after a public data incident is a message claiming to offer compensation, a refund, a security check or a failed-delivery fix. It may contain enough real details to look legitimate.
A genuine retailer does not need your bank PIN, full card security code or one-time banking code to issue a normal refund. If a message creates urgency, leave it and verify the request independently through the official ASOS app or website.
Should you cancel your bank card?
ASOS says it does not believe payment-card information was affected, so there is no general official instruction for every ASOS customer to cancel a card. If you see an unrecognised transaction, contact your bank using its official app or the number printed on your card.
What if you clicked the suspicious notification?
If you opened a suspicious link but did not enter information, close the page and avoid downloading anything it offered. If you entered a password, change it immediately on the genuine service and anywhere else you reused it. If you entered payment or banking information, contact your bank promptly.
Check whether your device installed an unfamiliar app, browser extension or configuration profile. Update the operating system and browser and run the device's built-in security scan.
Why phishing risk can last after the headline disappears
Exposed contact data does not expire when the news cycle ends. It can be combined later with information from other breaches or public sources. A scam may refer to ASOS weeks or months after this incident and still appear timely.
How can you tell an ASOS security message from a phishing message?
A convincing phishing email can copy the ASOS logo, colours and wording, so appearance alone is not a reliable test. Check what the message is asking you to do. Requests to reveal a one-time code, move money, install remote-access software or confirm banking credentials should be treated as major warning signs.
Instead of using the button in an unexpected email or text, open the ASOS app independently and look for the same alert inside your account. If the message concerns an order, compare the order number and status with your real order history. A mismatch is a strong reason to stop and verify.
Which accounts deserve priority if you reused a password?
Your email account should come first because access to email can allow an attacker to reset passwords on many other services. Banking, payment wallets, mobile-network accounts and cloud storage should also have unique passwords and strong multi-factor authentication.
Password reuse turns one compromised credential into a chain reaction. Even though ASOS says it does not believe its passwords were affected, the incident is a useful prompt to remove duplicated passwords before a different breach exposes them.
What should you monitor over the next few weeks?
Watch for password-reset messages you did not request, new-device login alerts, delivery messages for orders you did not place and unexpected changes to saved addresses. Check your bank and payment accounts normally, but do not assume every unrelated transaction is connected to ASOS.
It is also worth checking your mobile account for unexpected SIM-related notifications. A scammer with contact information may try to persuade a mobile provider that they are the account holder. A strong account PIN and current recovery information reduce that risk.
Should you delete your ASOS account?
Deleting an account is a personal choice, but it is not a substitute for securing the email address, passwords and payment accounts linked to your wider online identity. If you decide to close the account, first save any order or return information you still need and use ASOS's official account controls rather than a link sent in an unsolicited message.
FAQ: ASOS cyber incident
Has ASOS confirmed that passwords were stolen?
No. ASOS has said it does not believe account passwords were affected.
Were payment cards affected?
ASOS says it does not believe payment-card information was impacted.
Should every customer assume they are affected?
The NCSC advises ASOS customers to assume they are affected even if they did not receive the unauthorised notification.
Sources
Primary guidance: UK National Cyber Security Centre: Incident affecting ASOS customers. Company updates are listed in ASOS plc News and media.
More practical UK technology coverage is available in Technology.
