Story perspectives

ASOS Confirms Hackers Accessed Millions of Customer Profiles

By Drooid · Oct 8, 2026, 2:00 PM UTC · How we work

Summary

ASOS Data Breach

ASOS confirmed hackers accessed detailed profiles of potentially millions of customers.
Stolen data includes names, addresses, phone numbers, emails, customer numbers and search terms.
Hackers impersonated a trusted contact to hijack an employee’s login and reach a third-party database.
ASOS locked affected platforms, launched a cyber investigation and warned that passwords and payment details were not compromised.

Summary

ASOS Enlists NCSC

ASOS enlisted the National Cyber Security Centre (NCSC) of GCHQ to aid its investigation.
A credential-stuffing attack on July 28 exposed accounts, prompting password resets on July 29.
Check Point’s Charlotte Wilson warned that attackers exploiting push notifications can quickly erode consumer trust.
Analysts cite a surge in UK retailer cyber-attacks, including Marks & Spencer and Harrods.
Regulators said ASOS must notify the breach under UK GDPR breach-notification rules.

History

Historical Context

In November-December 2013, hackers infiltrated Target’s network through a third-party HVAC vendor, stealing credit-card data from up to 110 million customers and prompting FTC fines and tighter retail security standards that later shaped GDPR enforcement. On July 28 2024, ASOS suffered a similar credential-stuffing breach, drawing intervention from the UK’s NCSC, GCHQ and Check Point analyst Charlotte Wilson.

1 of 3

ASOS Data Breach

ASOS confirmed hackers accessed detailed profiles of potentially millions of customers.
Stolen data includes names, addresses, phone numbers, emails, customer numbers and search terms.
Hackers impersonated a trusted contact to hijack an employee’s login and reach a third-party database.
ASOS locked affected platforms, launched a cyber investigation and warned that passwords and payment details were not compromised.

1 / 3