On Tuesday 6 October, ASOS customers received a push notification from the retailer’s own app, titled “ASOS HACKED”. ASOS did not write it. BBC News has since reported the types of data now held by the attackers: names, addresses, phone numbers, email addresses, customer numbers and dates of birth, along with the searches customers made on the ASOS website. ASOS updated its customers after the BBC told the retailer that the attackers had been in contact.
For data protection practitioners, this incident deserves close attention. The way in was a person. The data sat in third-party platforms. And the information exposed includes something many organisations hold without much thought: a record of what their customers search for.
The investigation is ongoing, so we separate confirmed facts from our own commentary throughout. This article is correct as of 8 October 2026.
What we know so far
- 6th October: the notification, addressed to the ASOS DPO and IT team, claimed the attackers had compromised a Snowflake instance and threatened to leak data.
- The same day, ASOS said names and contact details may have been accessed, and that it did not believe payment card information or account passwords were affected.
- 8 October: ASOS confirmed the wider list of data after the attackers contacted BBC News.
- The ICO has been notified and is assessing the incident.
ASOS has not confirmed how many customers are affected. Snowflake says it has found no compromise of its own platform.
How the attackers got in
ASOS says an unauthorised party impersonated a trusted contact and persuaded an employee to hand over the login details for their work account. The attackers then used those details to access information on third-party platforms that ASOS uses.
This is social engineering. ASOS describes a person being deceived, and its account makes no mention of a software flaw. From what is public, one set of login details was enough to reach customer data held outside ASOS’s own systems. We do not yet know what technical access controls were in place, so we will not speculate on whether, and if so where, they fell short. However, once again, it demonstrates the vulnerabilities around staff particularly where they are a single point of failure within any given process or security control.
What the exposed data means for customers
No card details or passwords were taken, which limits the risk of direct financial loss. The main risk is targeted phishing. A message that quotes a customer’s name, address and a recent search looks credible. ASOS has told customers it will never ask for passwords, security codes or payment details through an unsolicited message or call.
Search history deserves particular attention. On its own, a search term says little. Linked to a name and address, terms about size, fit or occasion can reveal details customers would not expect to be shared. Practitioners assessing risks associated with a breach need to consider what data reveals in combination and consider whether they need to take that into account when looking at mitigation. The NCSC has issued guidance for those affected and there is also a statement from the ICO.
The data protection implications
Controller accountability
ASOS remains the controller for customer data held in third-party platforms where those platforms are acting as a processor. Article 32 (the security article) of the UK GDPR requires appropriate technical and organisational measures to be implemented. To decide what is appropriate, it’s important to be clear about the potential risk associated with the data and possible processing activities. This is likely to include harm associated with the data for data subjects and how any compromise may materialise for them. Article 28 requires controllers to use processors that provide sufficient guarantees to implement appropriate measures and protect the rights of the data subject and also requires a written contract to be in place that usually sets out some of the standards required. Those duties cover every platform where personal data sits that is provided by an organisation acting as a processor, including marketing tools.
Data minimisation and storage limitation
The incident raises a fair question for any organisation: which data do our marketing platforms hold, why, and for how long? Data you do not hold cannot be taken. There are also more technical considerations, including thinking about data segregation and permissions to minimise the volume of data that could be affected when security is compromised.
Breach notification
Article 33 requires a report to the ICO within 72 hours of becoming aware of a notifiable breach, which is one where there is likely to be a risk to the rights and freedoms of the data subjects. Article 34 requires organisations to tell individuals without undue delay where the risk to them is high, although it can be helpful in some situations to inform data subjects of personal data breaches regardless of the level of risk as they may be able to help mitigate the adverse consequences.
ASOS reacted quickly, although there may be room for improvement
ASOS acknowledged the incident on the day, restricted access to the affected platforms and notified the ICO. It told customers what was affected and confirmed what wasn’t, and gave specific advice on suspicious contact. Within two days, it explained in plain terms how the attack happened.
The early wording is the learning point. The first statement referred to “basic personal information”. The fuller list followed after the attackers contacted the media. When facts are incomplete, say so directly. State what you have confirmed, what you are still investigating, and when you will update people. It’s important, wherever possible, not to cause confusion which may lead to further upset or concern being experienced by those whose data is affected.
What happens next
Assuming the ICO investigate the incident, they will look at the measures ASOS had in place before the incident and how it responded. Outcomes can range from no further action to a reprimand or a monetary penalty. Affected individuals can also seek compensation under Article 82 of the UK GDPR. ASOS trades in more than 100 markets, so regulators outside the UK may take an interest, particularly where other legislation applies to their data, such as the (EU) GDPR.
Questions to ask in your own organisation
We do not know which controls ASOS had in place, although incidents like this remind us how important it is to continually review the measures we have implemented in our own organisation. These questions address this type of attack in any organisation:
- Is multi-factor authentication enforced on every platform that holds personal data, including marketing and communication tools?
- Can one account export customer data in bulk, and would anyone be alerted?
- Do staff have a set way to verify requests for login details, including requests from known contacts?
- Related to this, what is the culture within your organisation? How confident would your staff be to raise a concern relating to a trusted contact or supplier?
- When did you last review supplier access and security arrangements?
- Do your marketing platforms hold more data than they need? This may be because you’ve collected data that you don’t need or use, or it may be because you haven’t implemented appropriate retention.
- Do staff with access to customer data receive training specific to their role?
How Tkm can help
Tkm & Associates provides expert-led, role-based data protection training and consultancy for organisations that want practical guidance they can apply. If this incident has raised questions about your own arrangements, book a call with our team.
