ASOS said it is investigating an unauthorised app notification sent on 6 October 2026. The retailer said names and contact details may have been accessed, but it did not believe account passwords or payment-card information had been affected. Its initial findings are in an ASOS customer update.

The incident raises a practical concern for anyone who runs an online business: what happens when a service used to talk to customers becomes a source of alarming messages?

What ASOS has confirmed

The alert went out at about 10am. ASOS says it restricted access to third-party notification platforms and is working with specialists and authorities. Its website and app remained operational. ASOS's update said customers did not need to change their passwords at that time.

The attackers' claim remains unverified

TechRadar reported that the alert threatened a data leak and claimed access to a Snowflake environment. Receiving that message does not, by itself, establish that the claimed access occurred.

ASOS has not publicly specified the entry route or confirmed how many customers were affected. The National Cyber Security Centre (NCSC) advised all ASOS customers to assume they may have been affected, including people who did not receive the notification. That is precautionary advice, not confirmation that every account was accessed.

What customers can do

Be alert for unexpected messages about orders, refunds or account checks. A message that includes your name can still be fraudulent. The NCSC's phishing guidance explains how criminals use personal information to make scams more convincing.

  • Check updates by going directly to the retailer's website, rather than following a link in an unexpected message.
  • Do not provide passwords, payment details or verification codes in response to unsolicited contact.
  • If you receive a suspicious email or text, follow the NCSC's reporting guidance.

What website owners should review

Our assessment is that this is a useful prompt to review customer communication tools alongside the website itself. Email, SMS and push notifications all carry your brand into someone's inbox or onto their phone. Decide who should be able to send those messages and who can stop them if something goes wrong.

The NCSC's cloud authentication guidance recommends multi-factor authentication and processes for managing and revoking service credentials. Its access-control guidance also supports giving accounts only the permissions their work requires.

For a smaller business, that can mean checking administrator accounts, removing access for former staff and documenting the contact at each supplier who can help during an incident. These are general precautions, rather than an explanation of how the ASOS incident happened.

A useful review ends with clear responsibilities: who owns each service, who approves customer messages and who takes charge when the normal communication process breaks down.

Reporting checked on 7 October 2026. This article draws on ASOS's public update, NCSC guidance and TechRadar's reporting. Featured image: “A cell phone sitting on top of a wooden table” by appshunter.io via Unsplash.