If you have an ASOS account, an email claiming to offer compensation for the recent data breach might look convincing enough to open, especially if it contains your name, phone number, or details about something you recently searched for on the shopping app. That is exactly what makes the latest ASOS email scam concerning. Following a cyberattack disclosed in October 2026, criminals have a new opportunity to impersonate the retailer and target shoppers with messages that appear to come from a company they already know and trust.
The incident came to wider attention on October 6, when some ASOS customers received an unexpected push notification through the official app stating “ASOS HACKED” and directing them to Telegram. ASOS subsequently confirmed that an unauthorised person had gained access to an employee’s account by impersonating a trusted contact, allowing access to information held on certain third-party platforms. The company said its investigation found that some customer personal information had been accessed, while payment card information and account passwords had not been compromised.
For customers, the immediate concern is no longer just the original security incident. It is what criminals might do with the information they obtained. Fake ASOS emails, text messages, phone calls, refund offers, and discount vouchers can all be used to trick shoppers into handing over more personal information or money. Here is how the ASOS phishing scam works, what information may have been exposed, and what you should do if a suspicious message lands in your inbox.
What Happened in the ASOS Data Breach?
According to ASOS’s official statement, the incident involved an unauthorised person gaining access to an employee’s account after impersonating a trusted contact to obtain login credentials. Those credentials were then used to access information on certain third-party platforms used by the retailer. ASOS said it restricted access to the affected platforms and launched an investigation with internal and external cybersecurity specialists, while also working with relevant authorities.
The incident became public after customers received the unauthorised app notification, which claimed that ASOS had been hacked and included a link to a Telegram channel. The message alarmed shoppers because it appeared inside the company’s own app rather than arriving from an unfamiliar email address. However, receiving a notification through an official app does not mean every message sent through that channel has been authorised by the company.
Reporting by The Guardian on October 8 said the accessed information included customer names, contact details, and recent search histories. Other account-related information may also have been involved. The investigation was ongoing, so the precise scope of the incident should be understood in the context of the company’s latest updates.
ASOS has stated that payment card information and account passwords were not accessed, and that its website and app remained safe to use. This is reassuring, but it does not eliminate the possibility of phishing. Criminals do not necessarily need a password or bank card number to start a convincing scam; a name, email address, phone number, and some knowledge of a person’s shopping activity may be enough to make an unsolicited message seem genuine.
How the ASOS Email Phishing Scam Works
The danger following a data breach is that scammers can use real information to make a fake message feel personal. An ordinary phishing email might begin with a generic greeting and contain obvious spelling mistakes, but a targeted message could address you by name and refer to your ASOS account or recent shopping activity. That extra detail may make you less likely to question the sender.
One possible approach is a fake data breach compensation email. It might claim that ASOS is paying affected customers, ask you to complete a form, or direct you to a website where you must enter your bank details to receive a refund. Another message might say your account needs to be secured following the incident and ask you to verify your identity through a link.
Scammers may also advertise exclusive discount codes, apology vouchers, or special offers supposedly issued because of the breach. Since ASOS regularly sells clothing and fashion products online, an offer that looks like a genuine promotion could easily catch the attention of an existing customer. The message might lead to a counterfeit website designed to collect login credentials or payment information.
A further possibility is a phone call or text from someone pretending to work in ASOS customer support. The caller might claim there is a problem with your account, offer to help recover it, or ask you to read out a security code sent to your phone. Even if the person knows your name or other personal details, that does not prove they represent ASOS.
These are examples of potential follow-up scams, not confirmation that every type of message has already been reported in connection with this particular incident. The important point is that unexpected contact referring to the breach deserves extra scrutiny, especially when the sender wants you to click a link, disclose information, or act immediately.
What Information Was Stolen From ASOS Customers?
ASOS confirmed that some customer information had been accessed, including names and contact details, as well as certain account-related information. Subsequent reporting described the exposure of customer contact information and recent search histories. The company said payment card information and account passwords were not accessed.
The exposed details matter because they can be combined to create more believable phishing attempts. For example, an email address can be used to send a fake account alert, while a phone number gives a scammer another way to contact the same person. If a criminal also knows something about a customer’s recent searches, the message may sound even more convincing.
This does not mean every ASOS customer has had all their information exposed, or that every customer will receive a scam email. The information available from the investigation does not justify assuming that every account was affected in the same way. However, customers should be alert to unexpected messages, particularly those that appear to know details about their shopping activity.
How to Recognise a Fake ASOS Email
The sender’s address is a useful starting point, but it should not be your only test. Scammers can use misleading display names, lookalike domains, and convincing logos to make an email appear authentic. A message can also contain your real name and accurate personal details without being legitimate.
Be especially suspicious if an email claims you must act immediately to prevent your account from being closed, receive compensation, or avoid losing a refund. Urgent language is often used to stop people from checking the details carefully. Unexpected requests for passwords, one-time security codes, payment information, or identity documents are also reasons to stop and verify the message independently.
Pay attention to the destination of any link. A button labelled “Secure My ASOS Account” does not guarantee that it leads to the real ASOS website. Rather than clicking it, open the official ASOS app yourself or type the retailer’s website address into your browser and check your account from there.
ASOS explains on its official customer care page that scammers may impersonate the retailer through social media, fake Gmail accounts, WhatsApp, and fraudulent websites. The company advises customers to use its official website and verified social media accounts when dealing with it.
Remember that a message does not become trustworthy simply because it contains information that appears to have come from the breach. In fact, that may be precisely why the scammer’s approach seems convincing.
What Should You Do If You Receive an ASOS Scam Email?
If you receive a suspicious email about the ASOS data breach, do not click its links, download attachments, or reply with personal information. If the message offers compensation, a refund, or a discount, check the claim independently through ASOS’s official website or customer care channels instead of using the contact details supplied in the email.
If you want to check your account, open the official ASOS app or navigate to the website directly. ASOS has said that customers do not need to take action on their accounts based on the incident information available so far, although it advises remaining cautious about unexpected messages and calls. The company says it will contact customers directly if the completed investigation identifies a need for additional information, support, or action.
It is also sensible to use strong, unique passwords for your online accounts and enable multi-factor authentication wherever it is available. ASOS reported that account passwords were not accessed in this incident, so there is no need to assume that your password has been stolen. Nevertheless, if you reuse your ASOS password on other websites, changing those reused passwords is a worthwhile security measure.
Keep an eye on your bank statements and payment notifications for transactions you do not recognise. Although ASOS has said payment card information was not accessed, scammers may attempt to obtain financial details through subsequent phishing messages.
If you have already clicked a link but did not enter any information, close the page and avoid interacting with it further. If you entered your password, change it through the genuine website and update it anywhere else you reused it. If you disclosed bank details or card information, contact your bank using its official number immediately. Anyone who shared a one-time security code should also contact the relevant service promptly and check their account for unauthorised activity.
Is It Safe to Continue Shopping on ASOS?
Based on its published update, ASOS says its website and app remained safe to use throughout the incident and continue to be safe. It also reported that payment card information and account passwords were not accessed. Customers therefore do not need to assume that the retailer’s entire shopping platform has been compromised simply because the unauthorised notification appeared in the app.
However, the reported breach is a reminder that a company can experience unauthorised access to systems used for customer communications without every part of its service being compromised. It is also a reminder that criminals may exploit the publicity surrounding an incident to impersonate the affected company.
You can continue to shop through the genuine ASOS website or app, but be careful with emails, texts, calls, and social media messages claiming to offer help with the breach. If you are uncertain about a message, contact ASOS through its official customer care page rather than replying directly.
Conclusion
The ASOS email scam is a genuine concern in the aftermath of the October 2026 cyber incident, although not every email mentioning the breach is necessarily fraudulent. ASOS confirmed unauthorised access to certain third-party platforms and said some customer information had been accessed. It also stated that payment card information and account passwords were not compromised.
The risk now is that scammers may use the incident to send fake compensation offers, account verification requests, discount vouchers, and other phishing messages. Some may include real customer details to make their stories more believable, so even an email that appears unusually personal should be checked before you trust it.
My advice is to ignore unexpected links and verify every breach-related offer directly with ASOS. Do not pay a fee to claim supposed compensation, share a security code with someone who contacts you, or enter your login details on a website reached through an unsolicited message. Keep your account credentials secure, watch for unusual activity, and follow updates on the official ASOS unauthorised notification page.
The original incident is worrying, but you can reduce the risk of becoming a second victim by treating unexpected messages with caution and checking important claims through official channels.
Check out The Docusign Email Scam, I talked about earlier.
