--- title: "ASOS data breach: stolen customer profiles and… | Firevault" url: https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026 description: "ASOS confirms customer-data exposure after attackers hijacked its app notifications. What happened, what was taken and why a stolen login can put more than…" lang: en-GB --- Breaking News Updated as information becomes available News · Breach Analysis · 12 October 2026 · Breaking # ASOS data breach: stolen customer profiles and a hijacked app notification ASOS confirms customer-data exposure after attackers hijacked its app notifications. What happened, what was taken and why a stolen login can put more than contact details at risk. Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Mark Fermor CTO, CMO & Founder, Firevault 14 min read Share Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fasos-data-breach-customer-profiles-october-2026 Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fasos-data-breach-customer-profiles-october-2026&text=ASOS%20data%20breach%3A%20stolen%20customer%20profiles%20and%20a%20hijacked%20app%20notification%0A%0AASOS%20confirms%20customer-data%20exposure%20after%20attackers%20hijacked%20its%20app%20notifications.%20What%20happened%2C%20what%20was%20taken%20and%20why%20a%20stolen%20login%20can%20put%20more%20than%20contact%20details%20at%20risk. Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fasos-data-breach-customer-profiles-october-2026 Image: Conceptual editorial illustration of a warning notification on a phone beside clothing parcels and customer profile cards (https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fasos-customer-data-breach-october-2026.jpg) Conceptual editorial illustration of a warning notification on a phone beside clothing parcels and customer profile cards Why it matters ## What this means for organisations holding critical data ASOS customers did not first learn about the October incident from a carefully prepared security notice. They received an alarming message through the retailer’s own app, apparently sent by the people threatening to leak its data. What emerged over the following days was more substantial than a rogue notification. ASOS acknowledged customer-data exposure, explained that an employee’s credentials had been obtained through impersonation, and warned customers about unexpected messages and calls. BBC reporting showed that the material included personal profiles and shopping searches, not simply a list of names and email addresses. This is a confidentiality and customer-trust incident. ASOS said its website and app continued operating normally. That distinction matters: a business can keep trading while information about its customers has already left its control. _Reporting cut-off: 12 October 2026. This report covers the incident disclosed on 6 October, not earlier ASOS-related incidents. Company statements, independently reported findings and attacker allegations are distinguished below. The accompanying image is original conceptual artwork, not evidence from the attack._ ## What happened on 6 October At around 10am on 6 October, an unauthorised push notification was sent to ASOS customers. The message addressed the retailer’s data protection officer and IT team and claimed that its Snowflake instance had been fully compromised. It demanded engagement and threatened a leak. In its 6 October regulatory statement (https://www.lse.co.uk/rns/update-regarding-cyber-incident-uai1cpfip30ff77.html), ASOS confirmed the unauthorised notification and said it was investigating activity involving third-party platforms used to communicate with customers. It said it had immediately restricted access to the notification platforms and was working with internal and external specialist advisers and relevant authorities. The initial disclosure said that basic personal information, including names and contact details, might have been accessed. ASOS said it did not believe payment-card information or account passwords were affected. Its website and app were operating as normal, with no current disruption to operations. The same statement disclosed cyber security insurance, including business continuity (https://fire-vault.com/solutions/oss) cover, but said it was too early to quantify any potential impact on trading. Insurance coverage is not an estimate of loss, and normal operations do not establish that there will be no financial or reputational consequences. Customers were told to disregard the unauthorised message and not click its external link. The BBC’s customer-advice report (https://www.bbc.com/news/articles/ck1l3g8097rzo) describes the notification and the retailer’s response. ## How the picture changed The initial description of basic contact information was not the end of the story. According to the BBC’s 8 October investigation (https://www.bbc.com/news/articles/c3zxjdw5ywgpo), the people behind the attack contacted the broadcaster on Wednesday evening and supplied a sample of stolen information. The BBC reported that it held off publication to allow ASOS to contact customers first. ASOS subsequently acknowledged that customer profiles had been taken. The BBC described detailed profiles of potentially millions of users, but said the retailer did not answer its questions about the scale of the breach. This is not a confirmed total of affected people. The sequence is important. Early disclosures can change as investigators establish which systems were accessed and what those systems contained. A cautious first statement must not become a permanent assumption about the incident’s severity. ### Timeline at a glance - **6 October:** customers received the unauthorised notification; ASOS disclosed third-party platform activity, restricted access and said names and contact details might have been accessed. - **7 October evening:** according to the BBC, the attackers supplied a sample that showed a wider range of customer information. - **8 October:** ASOS updated customers. Reporting described personal profiles and shopping-search history, while the company explained that an employee account had been accessed after a trusted contact was impersonated. - **By this report’s 12 October cut-off:** the sources reviewed did not establish a final affected-customer count, the complete technical access chain or a final financial impact. ## What customer information was exposed The BBC reported that the material included: - Names, home addresses, telephone numbers and email addresses. - Customer account numbers and dates of birth. - Information showing how long someone had been an ASOS customer. - Searches customers had made on the website. Examples of search terms in the BBC’s report included clothing and fit preferences. The Guardian’s 8 October coverage (https://www.theguardian.com/business/2026/oct/08/asos-customer-data-accessed-hacker-posing-impersonated) also reported exposure of customer search histories alongside names, addresses and telephone numbers. There are two important qualifications. First, the publicly reported fields do not prove that every affected person had every field exposed. Second, the BBC’s description of potentially millions of profiles must not be converted into an exact breach count or treated as proof that every ASOS customer was affected. ASOS told customers that bank details and passwords had not been accessed, according to the BBC. Infosecurity Magazine (https://www.infosecurity-magazine.com/news/asos-data-breach-stolen-employee/) also reported the company’s assurance that payment information was not compromised. Those are company statements, not an independent forensic finding by Firevault. ## The entry point: a trusted contact impersonated ASOS told customers that an attacker gained access to an employee account by impersonating a trusted contact to obtain login credentials. Those credentials were then used to access information on certain third-party platforms used by ASOS, according to Infosecurity Magazine’s account of the customer email (https://www.infosecurity-magazine.com/news/asos-data-breach-stolen-employee/). That makes social engineering central to the company’s published explanation. The public account does not establish an employee acting maliciously, an insider conspiracy or a software vulnerability as the starting point. It also does not explain every step between the stolen credentials, the downloaded customer information and the ability to send push notifications. TechCrunch (https://techcrunch.com/2026/10/08/asos-confirms-breach-of-customer-data-after-hackers-send-rogue-app-notification/) specifically noted uncertainty about multi-factor authentication and access to the notification system. The practical question is therefore not just whether an employee can be deceived. It is how much information, authority and onward access one compromised identity can unlock. ## Snowflake and Simon AI: do not confuse the claims The notification claimed that a Snowflake instance had been fully compromised. The attackers, using the name Xuanyewen in BBC reporting, later claimed that they had used a platform called Simon AI, described as built natively on top of Snowflake, to access the data. Those are attacker claims. The BBC reported that Simon AI had been approached for comment (https://www.bbc.com/news/articles/c3zxjdw5ywgpo); the reporting reviewed here did not establish an independent confirmation of that technical account. Snowflake said its platform had not been breached. Infosecurity Magazine quoted its spokesperson saying the incident did not result from a vulnerability, weakness, flaw or misconfiguration in Snowflake’s service, platform or internal environments, and that no remediation was required for Snowflake customers. These statements are not interchangeable. Unauthorised access to information held through a customer account or connected service does not, by itself, establish a compromise of the underlying cloud provider. Equally, a provider’s statement that its platform was not breached does not mean that the customer information was safe. The defensible conclusion is narrower: ASOS confirmed unauthorised access involving third-party platforms and customer-data exposure. The full technical chain remains incompletely explained in public. ## Why profiles are more dangerous than a contact list Names and email addresses can support mass phishing. Add an address, date of birth, account number, customer tenure and shopping interests, and a criminal can make an approach feel much more personal. A message can refer to a real account, a plausible purchase preference or the breach itself. A caller can use accurate personal details to sound like a genuine support representative. A fraudster can invent a refund, account-verification request or delivery problem that seems relevant to the recipient. These are potential downstream risks, not evidence that every scenario has already occurred in this case. They explain why the absence of stolen payment-card data does not make the incident harmless. > Knowing your details is not the same as proving identity. A caller who can recite your address or account number may be using stolen information. Search history is also personal information when linked to an identifiable customer. It can reveal interests and preferences that the person did not expect to become an extortion asset. Its exact legal sensitivity depends on the information and context; this report does not classify every search term as special-category data. ## A trusted communication channel became leverage The unusual feature was not only the information accessed. It was the use of the retailer’s customer-notification channel to announce the attack. A push notification arrives through an app the customer recognises. That gives it a credibility that an unfamiliar email address may lack. In this incident, the wording appears designed to pressure ASOS publicly by involving its customers in the threat. This shows why communication permissions deserve the same scrutiny as data-export permissions. The ability to read customer records and the ability to broadcast a message are different powers. If a compromised account can reach both, the consequences extend beyond confidentiality into impersonation, reputational harm and customer confusion. It does not establish that every recipient’s phone was compromised. Receipt of an unauthorised app notification is not, by itself, evidence of malware on a device. ## What ASOS customers should do The immediate advice is to avoid turning the incident into an opportunity for a second attack. 1. **Ignore the unauthorised notification and its link.** Open the ASOS app yourself or navigate to its website independently rather than following a message about the breach. 2. **Treat unexpected calls and messages with caution.** ASOS told customers it would never request passwords, security codes or payment details through an unsolicited message or call, as reported by the BBC. 3. **Do not accept personal details as proof of identity.** A genuine-looking account number, date of birth or address could now be known to someone else. 4. **Review account activity through a trusted route.** If something looks wrong, contact ASOS using contact information obtained independently from its official website or app. 5. **Use unique passwords.** There is no published confirmation in the sources reviewed that customer passwords were stolen. If yours is reused elsewhere, replace it through the official service, not a link in a purported security alert. 6. **If you entered credentials or payment information after following a suspicious link, act on that exposure.** Change affected credentials through the genuine service and contact your bank promptly if financial information was supplied or a suspicious transaction appears. For further guidance, see the BBC’s ASOS customer-advice report (https://www.bbc.com/news/articles/ck1l3g8097rzo) and the NCSC’s guidance on phishing scams (https://www.ncsc.gov.uk/collection/phishing-scams). ## What businesses should review now The following are Firevault’s recommendations, not claims about controls ASOS did or did not have. - **Map identity reach across third-party services.** Identify which accounts can read, export, synchronise or distribute customer information, and which can send messages to customers. - **Separate powers where possible.** Routine campaign work should not automatically require unrestricted bulk export or administration of every connected platform. - **Strengthen authentication and verification.** Prioritise phishing-resistant methods where supported and verify unusual credential, support or access requests through an independent channel. - **Review persistent access.** Inventory service accounts, API keys, refresh tokens and integrations. A password reset alone may not remove every route created or used during an intrusion. - **Monitor high-impact actions.** Review bulk exports, unusual sign-ins, new integrations, permission changes and unexpected notification campaigns. Preserve logs before retention periods or emergency changes remove them. - **Reduce unnecessary copies.** Challenge how much identifiable customer history a marketing or analytics service needs, for how long, and who can export it. - **Prepare customer communications.** Use a known, verified update route and make clear what the company will never request. Explain what is confirmed, what is being investigated and when customers should act. This is an access-and-exposure lesson, not a reason to claim that every cloud service is unsafe. Connected systems remain necessary for retail, customer service and marketing. The task is to limit what each identity and integration can reach. ## The Firevault perspective: protect what need not stay connected An offline backup cannot retract information already stolen from an operational marketing platform. Restoring a clean copy does not undo a confidentiality breach, and no storage product should be presented as if it does. The relevant question is which valuable datasets or retained records genuinely need to remain continuously available through operational accounts. Current campaign data may need to be online. Historical archives, sensitive reference material and selected protected copies may not. Offline Secure Storage (https://fire-vault.com/offline-secure-storage)® is Firevault’s data storage and protection brand. It holds protected data physically disconnected and offline until access is authorised. That does not remove the need to secure the working copies left in connected systems, verify identities, minimise access or control exports. Protection while isolated and protection during an authorised session are different states. For organisations reviewing storage exposure, explore OSS (https://fire-vault.com/offline-secure-storage). For the separate question of governing physical network paths, Control by Firevault (https://fire-vault.com/control-for-critical-systems) addresses network evolution and rapid protection. Neither should be described as a retrospective cure for this incident or as a proven control ASOS was missing. ## What remains unconfirmed The sources reviewed for this report do not establish: - A final number of affected customers or records. - A complete field-by-field exposure statement for every customer. - The full sequence of access across third-party services and notification systems. - Whether, and how, multi-factor authentication was used or bypassed. - Independent confirmation of the attackers’ Simon AI account. - A final financial impact, regulatory outcome or complete public forensic report. - Whether the wider dataset had been publicly released by the reporting cut-off. The verified story is already serious without adding unsupported figures or technical certainty: an impersonated trusted contact, stolen employee credentials, exposed customer profiles and a customer-communication channel used for extortion pressure. ## Frequently asked questions ### Was ASOS hacked in October 2026? ASOS confirmed unauthorised activity involving third-party platforms and an unauthorised customer notification on 6 October. It later acknowledged customer-data exposure and said an employee’s credentials had been obtained by impersonating a trusted contact. ### How many ASOS customers were affected? A final total was not established in the sources reviewed by 12 October. The BBC reported detailed profiles of potentially millions of users. That is not an exact breach count and does not prove that every customer was affected. ### Were ASOS passwords or card details stolen? ASOS said payment information and customer passwords were not accessed. Reported exposure included personal details and search history. The assurance about passwords and payments is the company’s statement, not an independent Firevault forensic finding. ### Was Snowflake itself breached? Snowflake said its platform was not breached and the incident did not arise from a flaw in its service or internal environments. The attackers’ claims about a Snowflake instance and Simon AI must be distinguished from ASOS’s confirmed account of third-party access. ### Does receiving the notification mean my phone was hacked? No such conclusion follows from receiving the notification alone. The publicly reported incident involved misuse of a customer-notification platform. Do not click the external link; if you entered credentials or financial details, respond to that separate exposure. ### Would an offline backup prevent this kind of breach? An offline backup protects a copy from certain connected threats, but does not stop theft from a separate live customer platform or recover the confidentiality of stolen records. OSS protects the data held physically isolated; connected working copies still need their own controls. ## Sources and reporting notes - ASOS regulatory statement: Update regarding cyber incident, 6 October 2026 (https://www.lse.co.uk/rns/update-regarding-cyber-incident-uai1cpfip30ff77.html). Primary company disclosure, reproduced by London South East. - BBC: ASOS hackers took more personal details than first revealed, 8 October 2026 (https://www.bbc.com/news/articles/c3zxjdw5ywgpo). Reporting on the data sample, customer update and attacker claims. - Infosecurity Magazine: ASOS confirms data breach linked to stolen employee credentials, 8 October 2026 (https://www.infosecurity-magazine.com/news/asos-data-breach-stolen-employee/). Customer-email account and Snowflake response. - The Guardian: ASOS customers’ names, contact details and search histories hacked, 8 October 2026 (https://www.theguardian.com/business/2026/oct/08/asos-customer-data-accessed-hacker-posing-impersonated). Corroborating coverage of the expanded data exposure. - TechCrunch: ASOS confirms breach after rogue app notification, 8 October 2026 (https://techcrunch.com/2026/10/08/asos-confirms-breach-of-customer-data-after-hackers-send-rogue-app-notification/). Reporting on access and authentication uncertainties. - BBC: What can I do to protect myself after the ASOS message? (https://www.bbc.com/news/articles/ck1l3g8097rzo). Customer advice and reported responses. - NCSC: Phishing scams (https://www.ncsc.gov.uk/collection/phishing-scams). General guidance, not an incident-specific finding. Firevault has not accessed the stolen dataset and has not independently examined ASOS systems. Incident facts are attributed to the company and named reporting. The business recommendations and product discussion are Firevault analysis by Mark Fermor. About the author ### Mark Fermor Mark Fermor on LinkedIn (https://www.linkedin.com/in/mfermor) CTO, CMO & Founder Founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. How Firevault would handle this ## Controls an auditor can physically verify Firevault gives you physical separation, named custody and evidenced access, so compliance claims about isolation and control are things you can show, not just assert. Get started: https://fire-vault.com/get-started Talk to the team: https://fire-vault.com/demo **Custody**Named, access-controlled hardware in a Firevault Bunker **Evidence**Access windows and retrieval events are recorded **Separation**Physical isolation that satisfies offline copy requirements **Jurisdiction**Stored where your regulatory position requires Related Reading ## You may also find these useful Breach Analysis ### Dyfed-Powys Police confirms cyber attack as staff information may have been compromised Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The force says it has found no evidence that public data was accessed. 25 Sept 2026 3 min https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 Breach Analysis ### FBI investigates claims that hackers stole personnel and applicant data The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former personnel and job applicants. The claimed scale remains unconfirmed. 22 Sept 2026 4 min https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026 Breach Analysis ### Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later Families of vulnerable children in Wiltshire, Bath and North East Somerset have been told their personal health information may have been accessed in a cyber attack on HCRG Care Group in February 2025, more than 18 months after the incident. 20 Sept 2026 4 min https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026 Breach Analysis ### FBI and Coast Guard board oil tankers after suspected foreign cyberattacks on ships entering US waters US authorities boarded two foreign-flagged oil tankers in the Gulf of Mexico after indications their networks were compromised by foreign cyber actors. Mark Fermor on why a ship is a floating lesson in what happens when operational technology is reachable. 17 Sept 2026 4 min https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026 Breach Analysis ### FBI investigates 153 million drivers licenses put up for sale on a criminal forum A dark web service claimed to be selling scans of more than 153 million drivers licenses, apparently taken from a Louisiana identity verification company used by household names. The FBI has opened an inquiry, and the case shows how long retention turns a routine check into national-scale exposure. 16 Sept 2026 4 min https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026 Breach Analysis ### CenterPoint Energy confirms hackers stole customer data through an exposed API CenterPoint Energy has confirmed that criminals stole customer data through one of its external facing systems, after a threat actor advertised 7.49 million files on a dark web forum. Mark Fermor on what an unsecured API says about the way critical infrastructure treats connected data. 16 Sept 2026 4 min https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026 ## Suggested Reading - What is Offline Secure Storage The foundation of physical disconnection: https://fire-vault.com/how-it-works/offline-secure-storage - Why Offline Secure Storage The case for physical control: https://fire-vault.com/why-oss - Ransomware Defence Hold gold copies offline: https://fire-vault.com/oss-for-ransomware-recovery - Control Physical path control for IT and OT: https://fire-vault.com/solutions/control - Knowledge Vault All articles, guides and whitepapers: https://fire-vault.com/learn/knowledge - Book a Demo See Firevault in action: https://fire-vault.com/demo Back to Knowledge Vault: https://fire-vault.com/learn/knowledge ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026#webpage", "url": "https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026", "name": "ASOS data breach: stolen customer profiles and…", "description": "ASOS confirms customer-data exposure after attackers hijacked its app notifications. What happened, what was taken and why a stolen login can put more than…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fasos-customer-data-breach-october-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "ASOS data breach: stolen customer profiles and a hijacked app notification", "item": "https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "ASOS data breach: stolen customer profiles and a hijacked app notification", "description": "ASOS confirms customer-data exposure after attackers hijacked its app notifications. What happened, what was taken and why a stolen login can put more than contact details at risk.", "url": "https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fasos-customer-data-breach-october-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fasos-customer-data-breach-october-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fasos-customer-data-breach-october-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fasos-customer-data-breach-october-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-10-12T14:50:16.693772+00:00", "dateModified": "2026-10-12T14:50:16.693772+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 2686, "keywords": "ASOS, Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "ASOS customers did not first learn about the October incident from a carefully prepared security notice. They received an alarming message through the retailer’s own app, apparently sent by the people threatening to leak its data. What emerged over the following days was more substantial than a rogue notification. ASOS acknowledged customer-data exposure, explained that an employee’s credentials h", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Was ASOS hacked in October 2026?", "acceptedAnswer": { "@type": "Answer", "text": "ASOS confirmed unauthorised third-party platform activity and an unauthorised customer notification on 6 October, then acknowledged customer-data exposure after an employee’s credentials were obtained through impersonation." } }, { "@type": "Question", "name": "How many ASOS customers were affected?", "acceptedAnswer": { "@type": "Answer", "text": "No final total was established in the sources reviewed by 12 October. The BBC reported detailed profiles of potentially millions of users; that is not an exact count or proof every customer was affected." } }, { "@type": "Question", "name": "Were ASOS passwords or card details stolen?", "acceptedAnswer": { "@type": "Answer", "text": "ASOS said payment information and customer passwords were not accessed. Reported exposure included personal details and search history. That assurance is the company’s statement, not an independent Firevault forensic finding." } }, { "@type": "Question", "name": "Was Snowflake itself breached?", "acceptedAnswer": { "@type": "Answer", "text": "Snowflake said its platform was not breached and that the incident did not arise from a flaw in its service or internal environments. Attacker claims about a Snowflake instance and Simon AI remain distinct from ASOS’s confirmed account." } }, { "@type": "Question", "name": "Does receiving the notification mean my phone was hacked?", "acceptedAnswer": { "@type": "Answer", "text": "Receiving the notification alone does not establish a compromised phone. Do not click the external link; if you entered credentials or financial details, respond to that separate exposure." } }, { "@type": "Question", "name": "Would an offline backup prevent this kind of breach?", "acceptedAnswer": { "@type": "Answer", "text": "An offline backup does not stop theft from a separate live customer platform or restore the confidentiality of stolen records. OSS protects data held physically isolated; connected working copies still need their own controls." } } ] } ] ```