Asos hack was far worse than first admitted as hackers hold detailed profiles on potentially millions of customers

From the Newshound archive · first published 8 October 2026 · last updated 9 October 2026.

Hackers who broke into Asos's systems have obtained far more personal data than the fashion giant initially admitted, including names, addresses, phone numbers, dates of birth, email addresses and customers' search histories. Asos confirmed the update after being contacted directly by the cyber criminals, who said the breach went well beyond the "basic contact details" the company first acknowledged. The attacker gained access by impersonating a trusted contact to steal an employee's log-in credentials. Asos, which has 16.4 million active users worldwide, insists no bank details or passwords were taken.

The hackers' pop-up notification — sent via Asos's own app on Tuesday — read 'ASOS HACKED' and directed customers to a Telegram account threatening to leak the data.

Armed with customers' search terms such as 'reclaimed vintage' and 'Asos petite', criminals can craft highly personalised phishing calls and emails, security experts warn.

One affected customer, Harriet, told the BBC it was 'very unsettling', adding: 'Stolen data can be used as a tool for future attacks well beyond the initial incident.'