Short answer: ASOS says your card details and password were not taken, but your name, contact details, and even your shopping searches may have been. That makes the next fake message look real.
In October 2026, ASOS customers found out through a notification in the ASOS app that the company had been hacked. ASOS confirmed that criminals got in by tricking an employee into handing over login details, then used them to reach systems the company uses to personalize shopping for customers. The attackers reportedly demanded payment to delete the data.
ASOS says it locked down the affected systems, strengthened its security, and will contact customers directly if they need to take any action.
According to reports based on a sample of the stolen data, it includes:
ASOS says payment card information and customer passwords were not accessed, and that its website and app remain safe to use.
As security company Malwarebytes put it, a message that knows your name, or even what you searched for, isn't proof it came from ASOS.
Stolen details are often used weeks or months later. Expect texts, emails, and calls about an order, a refund, a delivery, or a problem with your account. Some may mention the exact items you searched for, which makes them feel genuine. The attackers have also posted messages pointing people to a Telegram channel. Don't follow it or engage with them.
This advice works for any company breach: when your details are out there, trust the app, not the message.
Source: Malwarebytes: ASOS breach update, hackers stole customer details and shopping searches
This is one trick out of dozens. The Scam-Proof Playbook covers phishing after data breaches, fake refund and delivery messages, account takeovers, and more, in plain language, with real examples.