âš‘ Data breachOctober 24, 2026
ASOS app users received a push notification on October 6, 2026 that began "ASOS HACKED," according to Malwarebytes. ASOS later told customers an unauthorised party got into an employee account, according to Computer Weekly and Express & Star, and said no card information or account passwords were accessed.
The short version
Company: ASOS
People affected: Not stated; ASOS's website lists 17 million customers (TechCrunch)
Data exposed: Names, contact details and account-related information, per ASOS
When it happened: Alert sent October 6, 2026
What's offered: ASOS says no action is needed on your account
A hacked app alert
According to Malwarebytes, ASOS app users received a push notification on October 6, 2026 that began "ASOS HACKED." Malwarebytes says the message was addressed to ASOS's data protection officer and IT team and demanded that they "engage with us, or we will leak it." The group behind it calls itself "Xuanye Group," Malwarebytes reported. Malwarebytes, citing The Independent, says ASOS issued its full statement about five hours later. ASOS is a UK-based online fashion retailer that ships worldwide.
In an email to customers quoted by Computer Weekly and Express & Star on October 8, 2026, ASOS said an unauthorised party got into an employee account by impersonating a trusted contact to obtain login credentials. ASOS said those credentials were then used to reach information on third-party platforms. The company said no payment card information and no account passwords were accessed, and that its website and app were safe to use throughout. TechCrunch reported that Snowflake, a cloud data platform the attackers named, said its own systems were not breached.
What data, and how many people
ASOS's email lists names, contact details and certain "non-personal" account-related information, according to the outlets quoting it. Malwarebytes says the BBC saw a sample from the attackers that also included customer numbers, dates of birth, searches made on the ASOS website, and when customers started using ASOS. Computer Weekly reported the scope is wider than first reported. ASOS has not said how many people are affected. ASOS said its investigation will continue for several weeks and that it will contact customers directly where more support or action is needed. It said it is working with law enforcement and regulators.
What to do if you're a customer
ASOS told customers, "there is no action you need to take on your account," according to the outlets quoting its email.
ASOS says to be cautious of unexpected messages or calls claiming to be from ASOS. It says it will never ask for passwords, security codes or payment details by unsolicited message or call.
ASOS says it will contact customers directly if more is needed. Watch for an email from the company.
Malwarebytes, citing a Yahoo Finance UK report, says the group gave ASOS two weeks to make contact and wanted a ransom to delete the data. ASOS has not said whether it would pay.
Sources
Malwarebytes: ASOS breach update, hackers stole customer details and shopping searches, October 9, 2026
This story is based on the records and reports linked above. Charges, lawsuits, and other accusations are claims, not findings of guilt or liability, unless the story says a court has ruled.
