ASOS
London-listed online fashion retailer, a member of the FTSE 250 index.
An unauthorised push alert went out through the ASOS app on 6 October 2026, and the NCSC told every ASOS customer to assume they were affected. ASOS says names and contact details were accessed, not cards or passwords.
Last refreshed: 12 October 2026 · Appears in 1 active topic
If attackers can push alerts through the ASOS app, which messages can customers trust?
Timeline for ASOS
Confirmed customer names and contact details were accessed
Cybersecurity: Threats and Defences: ASOS app pushes rogue alert to customersBackground
ASOS, the London-listed FTSE 250 online fashion retailer, had a rogue push alert sent through its app on 6 October 2026. The NCSC told every ASOS customer to assume they were affected, and ASOS said customer names and contact details were accessed, not cards or passwords.
The NCSC warning, issued the same day, also told ASOS shoppers to expect follow-on phishing and to distrust links in app notifications. ASOS traced the break-in to a social-engineering approach: someone posed as a familiar contact, talked a staff member out of a login, and used it on outside services the retailer relies on, the company told City A.M. ASOS has informed police and regulators.
The rogue alert blamed a breach of the retailer's Snowflake data; Snowflake said its own platform was not compromised. A Telegram channel calling itself Xuanye Group says it holds ASOS customer records, a claim no investigator has verified. ASOS stock dropped more than 13 per cent on 6 October, City A.M. reported. Weeks earlier Astrana Health had disclosed a similar intrusion by attackers posing as its staff.