ASOS Data Breach 2026: H&M Probe and What To Do

ASOS has confirmed that hackers took customer names, contact details and shopping search histories after someone tricked an employee into giving up login details. Payment card details and account passwords were not accessed, according to the company.[1][3][6]

On October 12, 2026, H&M said it is investigating online claims of a cyberattack that The Times links to the same group, which calls itself Xuanye. H&M says it has no indication so far that its data environment was compromised.[4] If you shop at either brand, the main risk now is convincing phishing, not stolen money. Below are the confirmed facts, what is still unknown, and six free steps.

ASOS and H&M breach timeline

The dates below come from ASOS statements and from the press reports we link at the end. Times are as reported.

• October 6, 2026. Customers receive a push notification titled "ASOS HACKED" through the ASOS app. Sky News reports that ASOS confirmed an unauthorised customer notification was sent around 10 am.[2][5]
• October 6, 2026. ASOS says it is investigating unauthorised activity on third-party platforms. Its shares fall more than 14% in trading and close down 9.56%.[2]
• October 8, 2026. After what the Guardian calls a detailed 48-hour investigation, ASOS confirms that basic personal information was accessed. It files an update with the London Stock Exchange.[1][3]
• October 9, 2026. Malwarebytes publishes a fuller list of the data that was taken.[6]
• October 12, 2026. H&M says it is aware of online claims and is investigating. The Times says the group behind the ASOS attack targeted H&M last week.[4]

The short gap between the fake alert and the confirmation matters. For about two days customers had only the attackers' words and a short ASOS apology. The company's first statement said it did not believe card data or passwords were affected, and its later findings did not change that.[2][3]

What happened at ASOS

On the morning of October 6, thousands of ASOS app users saw a push notification that read "ASOS HACKED." The text was addressed to the company's data protection officer and IT team. It said the attackers had fully compromised the Snowflake instance and ended with "Engage with us, or we will leak it."[2][5][7]

The message carried a link to a Telegram channel run by a group calling itself Xuanye Group. Hackread reviewed the channels and found a gateway channel that pointed to a second broadcast channel. The group posted that payment information was not affected and that the ASOS app was safe to use.[7]

ASOS responded the same day. It said it was investigating unauthorised activity involving third-party platforms it uses to communicate with customers, had restricted access to those notification platforms, and was working with specialists and authorities. It later apologised and asked customers to disregard the notification and not click the external link.[2]

The UK National Cyber Security Centre said it was offering help to ASOS. Its chief executive, Richard Horne, said the notification showed that cyber incidents do not only affect big business but can reach individuals too.[2][7]

By October 8, ASOS had a clearer answer. It told customers that an unauthorised party gained access to an employee account by impersonating a trusted contact to obtain login credentials, and that those credentials were used to reach information on certain third-party platforms.[3] The affected platforms were locked down.[3]

What data was taken in the ASOS breach

ASOS has been careful in what it says. Its own wording is that names and contact details were accessed, along with some non-personal account information.[1][3] Press reports and security researchers fill in more detail.

Search history is the unusual part. It shows what a person looked at, such as sizes or styles, and it is the kind of detail scammers like because it makes a fake message feel personal. Simon Phillips of CybaVerse told the Guardian that ASOS regularly sends reminder emails about items customers searched for, so attackers could copy that style.[3]

The attackers have not said how much data they hold. TechCrunch notes that Xuanye Group has not indicated the size of the haul, and Hackread says the group has not published a sample.[1][7] Treat any number you see online as a claim until ASOS or a regulator confirms it.

Is my ASOS account affected

If you have ever had an ASOS account or used the app, assume your name and contact details could be in the stolen data. ASOS has about 17 million customers, and it has not said how many records were accessed or how many people received the fake notification.[1][7]

ASOS told customers there is no action they need to take on their account, and that the website and app remain safe to use.[3] That fits the company's statement that passwords and card details were not involved.

Our analysis: no password was taken, so a forced reset is not required. Still, one extra step costs nothing. If you reuse your ASOS password anywhere else, change it on the other sites. People who reuse passwords are the ones most hurt when a retailer's data is later combined with older leaks.

ASOS has promised to contact customers directly where it believes more information or support is needed.[3] Until you hear from the company, the safest assumption is that your name, contact details and search history are in someone else's hands.

H&M investigates cyberattack claims after the ASOS breach

The Times reported on October 12 that H&M Group, the owner of H&M, Cos, Arket and Monki, is investigating claims of a data breach. The paper says H&M is understood to have been targeted last week by the same cybercriminals behind the ASOS attack, who call themselves Xuanye, a name it translates as "Mysterious Splendour."[4]

An H&M spokeswoman said the company is aware of claims circulating online about a potential cybersecurity incident involving a limited scope of H&M Group data. She said H&M is investigating to assess their validity and has so far no indication that its data environment has been compromised.[4]

Some headlines have tied the H&M story to ShinyHunters, a better known extortion crowd. The articles we read name Xuanye Group, not ShinyHunters, and we found no source that confirms a link between the two. We are reporting what the sources say and no more.

So, is your H&M account affected? Nobody can say yet. The extent of any intrusion and whether other company data was touched remain unclear, according to the Times.[4] H&M has not confirmed a breach, and it has not said what kind of data the claims concern.

How the attackers got in

ASOS says the entry point was a person, not a software flaw. An attacker posed as a trusted contact and got an employee's login credentials.[3] The Times says it understands a junior employee received a phone call from the hacker asking them to change their password.[4]

This tactic is often called vishing, or voice phishing. The caller sounds helpful and official, and the employee hands over the key. No firewall stops a person who willingly gives away a password.[4]

The hackers claimed they reached a Snowflake data instance. Snowflake said it had not experienced a breach of its own systems, and Hackread points out that earlier Snowflake customer incidents came from stolen credentials on individual accounts.[1][7] In 2024, attackers accessed data belonging to at least 165 Snowflake customers, including AT&T, Ticketmaster and Santander, in incidents linked to stolen credentials and accounts without multifactor authentication.[7]

It is not known whether the ASOS account was protected by multifactor authentication.[1] It is also not known how the attackers reached the system that sends in-app notifications, which TechCrunch notes is often handled by a third-party service.[1]

Malwarebytes noted that ASOS has described using a personalization tool and a messaging platform to send push notifications, but that this public description does not prove what the attackers touched.[5] ASOS itself has not named the platforms involved.[7]

Phishing and scams to expect after the ASOS breach

This section is our analysis, based on the data reported and on advice from the security experts quoted by the press.

Names, phone numbers, emails and search history are exactly what a scammer needs for a believable message. Marijus Briedis of NordVPN told the Guardian that criminals may send emails and texts claiming to be from ASOS, perhaps asking for a password reset, payment details, an order check or a refund claim.[2] Malwarebytes gives the same warning about messages on refunds, deliveries and account problems.[6]

• An email or text that says your ASOS account is locked and sends you to a link to "verify" it.
• A message that offers a refund or compensation for the breach and asks for card details.
• A call from someone who says they are from ASOS or your bank and already knows your name and address.
• A delivery or return notice that mentions an item you recently searched for.
• Another push notification or a Telegram message that claims to come from the hackers or from ASOS.

The Guardian reports that shoppers should be especially wary of unexpected calls, texts, messages and emails in the coming weeks and months.[3] ASOS says it will never ask you to share passwords, security codes or payment details through an unsolicited message or call.[3]

If a message feels off, paste any link into our website safety checker before you open it. If you get a fake message, you can report it using our guide on how to report phishing.

What to do now: six steps

1. Ignore the Telegram link and do not engage. ASOS asked customers to disregard the notification and not to click the external link it contained.[2] Malwarebytes gives the same advice and tells people not to engage with the attackers.[6] If you already tapped the link, do not enter any details, close the page and keep the rest of these steps in mind.

2. Check your account only inside the official app or site. Type the address yourself or open the app you already installed. Do not use links from email, texts or social media.[7] ASOS says its website and app are safe to use.[3] If you want more control over notifications, see how to stop push notification spam, and use your phone's settings: our guides for iPhone and Android cover them.

3. Distrust unexpected calls, texts and emails. If you are not sure who you are speaking to, end the conversation and contact the company directly, as the Guardian advises. In the UK you can dial 159 to reach your bank's fraud team, or use the number on the back of your card. If you suspect a fraud call, wait at least 15 minutes before calling back, or use a different phone.[3]

4. Change reused passwords. This is our advice, not a requirement from ASOS. If your ASOS password is also used on another account, change the other accounts and turn on two-step verification where you can. Do it from the site or app, not from a link in a message.

5. Watch your card and bank accounts. ASOS says card details were not accessed, so no card should be at risk from this breach alone.[2][3] The danger is a scammer who calls with your real name and talks you into approving something. Review statements for the next few months and report anything odd to your bank at once.

6. Know your rights. In the UK, the ICO says you can complain to the organisation and ask what happened, what information was affected and what it plans to do. The organisation has 30 days to acknowledge your complaint, and the ICO recommends giving the company a chance to respond before you contact the regulator.[9] In the US, a credit freeze is free and you place it by contacting Equifax, Experian and TransUnion. An initial fraud alert lasts one year and can be renewed.[8]

Our analysis on the US steps: no Social Security number or card number has been reported in this breach, so a credit freeze is optional here. It is still free, and it is a good habit if your name and contact details are floating around.[8] For a wider list of recent incidents, see our data breaches hub.

How this compares with other retail breaches

The ASOS case is unusual in how the news arrived. Instead of a quiet notice weeks later, customers heard it from the hackers through the retailer's own app. TechCrunch notes a similar pattern earlier this year, when fintech firm Betterment was compromised by hackers who used a third-party marketing platform to send a fake crypto scam notification to users.[1]

The Guardian also recalls last year's attacks on UK retailers Marks & Spencer, the Co-op and Harrods. M&S and the Co-op faced stock shortages, and M&S closed its website for several weeks.[2] Sources told the Times that the ASOS incident is nowhere near the same scale, because at ASOS it was just the customer relationship management system.[4]

The lesson for shoppers is the same each time: your data lives in many places that are not controlled by the store you see. For another large retail example, read our report on the Shein data breach that affected 6.4 million users.

The business effect was quick. ASOS shares closed down 9.56% on the first day after dropping by more than 14% in trading, and the company said it has cyber insurance with a large global provider but that it is too early to quantify any impact on trading.[2]

Why push notifications are now an attack route

Most people see push notifications as harmless banners. This case shows why they matter. A push message appears on the lock screen with the brand's name and icon on it, and many people trust it more than an email. The attackers used that trust to reach customers directly.[2][5]

Dray Agha of security firm Huntress told the Guardian that sending a ransom demand straight to consumer devices is an aggressive extortion tactic designed to force the business into a quick negotiation.[2] The tactic puts pressure on the company, but customers get caught in the middle.

For you, the practical rule is simple. A push notification is not proof of anything. If a banner asks you to tap a link, treat it like a link in a text message from an unknown number, and open the app on your own instead.

What is still unknown

• How many ASOS customers had their data taken, and which countries they live in. ASOS has not published a number.[7]
• Whether dates of birth and customer numbers were taken. Malwarebytes lists them, but the ASOS statements we read do not.[3][6]
• Which third-party platforms were involved. ASOS has not named them.[7]
• Whether the ASOS account that was used had multifactor authentication.[1]
• How the attackers reached the system that sends push notifications.[1]
• Whether Xuanye Group will publish the stolen data. It said the data would not be touched for a designated period.[2][7]
• Whether the H&M claims are true, what data they cover, and whether any link to ShinyHunters exists. H&M says it has no indication so far of a compromise.[4]

We will update this article when ASOS, H&M or a regulator publishes more. It was last checked on October 12, 2026.

Related guides on 2-Spyware

• Check a link or website with our safety checker
• How to report phishing messages
• Stop push notification spam on your phone and browser
• Shein data breach that affected 6.4 million users