ASOS customers' names and contact details were accessed
The UK NCSC said some ASOS customers got an unauthorized push notification on October 6, 2026. ASOS told the NCSC that names and contact details were accessed, and that it does not believe card numbers or account passwords were.
What was reported
The NCSC alert, published October 6, 2026 and updated October 8, says some ASOS customers received an unauthorized push notification from ASOS on Tuesday, October 6. ASOS told the NCSC it is investigating, that personal information including name and contact details was accessed, and that it does not believe payment card information or account passwords were affected.
The NCSC does not describe how the access happened. This note does not fill that in. It says customers should assume they are affected even without the notification, avoid suspicious links in push messages and email, and use a passkey or a strong unique password with two-step verification.
A store app that can notify every customer is a broadcast tool. Whoever holds that credential can speak as the brand.
How to prevent it
The system that sends a push notification is an account. Protect it the way you protect the customer table: separate credentials, a second factor, and no shared inbox password. If names and contact details leave, tell customers what was accessed and expect phishing that uses those details. The NCSC says ASOS customers should assume they are affected even if they never saw the notification.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.