Summary
ASOS, one of the UK’s largest online fashion retailers with tens of millions of active customers globally, has confirmed a data breach after customers received in-app notifications reading “HACKED”. The notifications appear to have been sent by the attacker through ASOS’s own notification infrastructure, either as a demonstration of access or as a deliberate act of disruption. ASOS has confirmed the breach and is investigating. The use of the victim platform’s own notification system to announce the breach to customers is an unusual tactic that maximizes visibility and reputational damage.
Timeline
| Date | Event |
|---|---|
| Oct 7, 2026 | ASOS customers receive in-app HACKED notifications; ASOS confirms breach; BleepingComputer reports |
What Happened
ASOS operates a major e-commerce platform handling customer personal data including names, addresses, email addresses, order history, and payment information for tens of millions of registered users. The attacker’s decision to send in-app notifications through ASOS’s own infrastructure suggests they had access to ASOS’s notification or push messaging systems — a level of access that typically indicates significant depth of compromise beyond simple database exfiltration.
The “HACKED” notification tactic serves multiple purposes from the attacker’s perspective: it creates immediate public awareness of the breach, maximizes reputational damage to ASOS, demonstrates the depth of access achieved, and may be intended to pressure ASOS into paying a ransom by making non-disclosure impossible. ASOS customers should treat their account credentials as compromised, change passwords, monitor for unauthorized orders, and watch for phishing attempts using their ASOS account details.
Domain Intelligence
asos.com — 62.18
asos.com scores in the low-trust range at 62.18. ASOS is the victim organization whose platform and notification infrastructure were compromised.