ASOS customer data was stolen, and the hackers announced it through ASOS's own app. What to do
ASOS says hackers took customer details after tricking an employee, and sent a threat through its app. What was taken, what wasn't, and how to protect yourself.
Stated by the maker, publisher, or platform holder.
On the morning of 6 October, people with the ASOS app got a push notification that didn't come from ASOS. It came from hackers, claiming they had the retailer's customer data and threatening to leak it. ASOS has since confirmed that customer data was taken.
If you shop with ASOS, here's what's known and what to do. ASOS's own statements are marked Confirmed; details from a sample the hackers gave to the BBC are marked Reported.
What ASOS has confirmed
What the hackers' sample shows
ASOS hasn't said how many customers are affected. It has about 17 million customers in total.
What to do
You don't need to change your card. ASOS says payment details weren't affected, and nothing reported so far says otherwise.
Change your ASOS password anyway if you reuse it elsewhere. ASOS says passwords weren't taken, but if your ASOS password is the same as any other account's, now is a good time to fix that.
Expect convincing scams. This is the real risk. Someone with your name, address, date of birth and order history can write a very believable "ASOS refund" or "delivery problem" email, text or call. Treat any unexpected message about your ASOS account, a refund or a delivery as suspect.
Go direct. Don't click links in those messages. Open the ASOS app or type the website address yourself to check your account.
Never hand over codes. No real retailer will ask you for a password, a security code or card details in an unexpected message or call.
Why it's unusual
Most breaches are announced by the company. This one was announced by the attackers, through the company's own app, before ASOS said anything. That's a reminder that the systems retailers use to message you, often run by outside providers, are a target in their own right, and that an app notification isn't proof a message is genuine.
We'll update this page when ASOS says how many customers are affected.