Use a route you open yourself. Check ASOS Customer Care for updates and avoid engaging with the external link in the unauthorised notification.
What is the ASOS hack notification?
ASOS confirmed that an unauthorised customer notification was sent at around 10am BST on 6 October 2026. Its company statement says it is investigating activity involving third-party customer communication platforms and has restricted access to those platforms.
The ASOS customer notice provides the official route for enquiries. The message’s appearance through an app customers recognise makes it especially unsettling, but each claim about the incident still needs evidence.
Why did customers receive an “ASOS HACKED” alert?
Reuters reported that the notification claimed an ASOS Snowflake instance had been compromised and threatened a leak unless the company engaged. It also included a Telegram link.
The wording was directed at the company’s data protection officer and IT team. Customers should use ASOS’s official support channels rather than treating the message as instructions for fixing an account.
Our assessment
The key question for shoppers is what the incident means for their information and their next actions. Receiving a message and disclosing a password are different events; keep a record of what actually happened so you can choose the appropriate response.
We would not infer the initial access method from the notification alone. A technical explanation requires evidence from the investigation, such as the affected service, account or credentials. Avoid treating guesses about an entry point as established facts.
What customer information may have been accessed?
| Area | Current position | Practical meaning |
|---|---|---|
| Names and contact details | May have been accessed. | Verify unexpected messages independently. |
| Account passwords | Not believed to have been impacted. | Assess any password you disclosed separately. |
| Payment-card information | Not believed to have been impacted. | Contact your bank if you shared details or identify suspicious activity. |
| Website and app | Operating normally, with no current operational disruption. | Availability does not settle the investigation’s scope. |
The company’s wording expresses its current assessment. Our recommendation is to keep checking the official notice for changes rather than extending it into a guarantee about every customer or record.
What if you did not receive the notification?
The NCSC advises ASOS customers to assume they are affected even if they did not receive it. Treat that as precautionary guidance; it does not establish that every customer’s data was stolen.
What does the Snowflake claim mean?
Snowflake told Reuters that it had found no compromise of its platform. That leaves the claim about the ASOS environment unresolved; it should not be expanded into a confirmed breach of Snowflake itself.
For customers, the useful distinction is between an allegation made in a threatening message and a finding supported by the investigation. We would look for a statement that identifies which environment was accessed, what information was involved and how the conclusion was reached.
Older incidents involving a named technology do not establish the cause of this incident. The customer response should follow the current evidence and official guidance.
What should ASOS customers do now?
The NCSC’s data breach guidance recommends checking with the organisation through official channels, watching for suspicious messages and reviewing accounts for unauthorised activity. Our practical way to apply that advice is:
- Open the support page yourselfUse your usual bookmark or type the genuine ASOS address. Navigate to Customer Care and read the incident notice before following a request received in a separate message.
- Record any action you tookNote whether you only saw the notification, followed a link, entered information or installed something. Keep relevant screenshots, without sharing private details publicly.
- Check your account through the genuine serviceLook for activity or changes you do not recognise. Report specific problems through the official support route; give the time and the details needed to identify the issue.
- Review password reuseIf you disclosed a password, change it on the real service and anywhere else you used it. A unique password limits the impact if credentials from one account are exposed.
- Keep the recovery route secureYour email account may be used to reset other accounts. Review its security settings and enable additional sign-in protection where available.
Do not use the incident as a reason to trust an unsolicited “security adviser”. Check any offer of help through a contact route you already know.
What if you clicked the link or shared information?
The NCSC’s phishing response guidance separates the response by what you did. Start with the relevant situation below.
| What happened? | What to do next |
|---|---|
| You only received or read the alert | A notification alone does not establish device compromise. Avoid its link and check official updates. |
| You opened a link | Stop engaging with it. Review whether you downloaded anything, granted permissions or submitted information. If you opened it on a computer, follow the NCSC’s advice to run a full antivirus scan where available. |
| You entered a password | Change it on the genuine service and on any other account using the same password. |
| You supplied banking details | Contact your bank through its official app or a trusted number and explain what you shared. |
| You installed software | Use the relevant device-security or IT support route. Follow the NCSC’s scan and clean-up guidance for a computer. |
| You used a work device | Tell your IT team what happened so it can assess the exposure. |
If you have lost access to an account or suspect somebody changed it, use the official account recovery process. The NCSC recommends checking for attacker-made changes after regaining access, including recovery information and, for email accounts, forwarding rules.
Our recommendation is to give support a precise account of your actions. “I received the notification at 10am and entered a password on a linked page” is more useful than guessing that an entire phone was hacked.
How could follow-up phishing scams exploit the news?
The NCSC warns that criminals use publicity around breaches to make scam messages convincing, including messages aimed at people whose details were never stolen.
Illustrative requests to verify independently
- A refund message that asks for card details on an unfamiliar page.
- A warning that an account will close unless you enter a password immediately.
- A delivery update asking for an unexpected fee through a text-message link.
- An offer of compensation that asks you to install an app or allow remote access.
These are examples of warning signs, rather than confirmed messages from this incident. Open the genuine service separately to check the underlying request.
For suspicious emails in the UK, the NCSC’s reporting address is report@phishing.gov.uk. Suspicious texts can be forwarded to 7726. Those routes are for email and SMS; do not treat them as instructions for forwarding an app push notification.
If money has been lost, the NCSC advises contacting your bank and reporting through the appropriate fraud or police route. Its current guidance links to Report Fraud for England, Wales and Northern Ireland, and explains the police route for Scotland.
Can a VPN protect you from this kind of incident?
As Cloudflare’s VPN explanation describes, a VPN encrypts the connection between your device and a VPN server. It cannot control access to a retailer’s customer systems or undo data you send to a phishing page.
Our advice is to match the control to the problem. Use account recovery if credentials were disclosed, speak to the bank about banking information and verify customer-support requests independently. Switching VPN providers would not remediate the retailer’s incident.
What to check in the next official update
Look for clearer information about affected customers, the categories of data involved and any specific action requested. We would review the advice above against those findings as they become available.
Frequently asked questions
Has ASOS confirmed a data breach?
ASOS has confirmed unauthorised activity and says names and contact details may have been accessed. The full extent of any customer-data exposure remains under investigation.
Were ASOS passwords or payment-card details affected?
ASOS says it does not believe account passwords or payment-card information were impacted. This is the company’s current assessment, rather than a guarantee about the final investigation findings.
Am I affected if I did not receive the notification?
The NCSC advises ASOS customers to assume they are affected by the incident even if they did not receive the notification. Follow official updates and remain alert to suspicious messages.
Does receiving the notification mean my phone was hacked?
Receiving the notification alone does not establish that your phone was compromised. If you followed a link, installed software or disclosed information, assess those actions separately and use the relevant recovery guidance.
What should I do if I entered my password on a linked page?
Change that password through the genuine service and change it on any other account where you reused it. Review account activity and use the official recovery process if you cannot regain access.
Has Snowflake confirmed its platform was hacked?
Snowflake told Reuters that it had found no compromise of its platform. The claim about an ASOS Snowflake instance should not be treated as a confirmed platform-wide breach.
Can a VPN protect me from the ASOS incident?
A VPN cannot prevent unauthorised access to a retailer’s systems or undo information you give to a scammer. Use official support routes, protect your accounts and verify unexpected requests independently.