ASOS — Data breach

New incident
Not stated
Reported

What this record states

ASOS has reported a data breach.

The source states that information about customers was involved, across 3 categories of personal information.

No source consulted for this record states when the incident occurred and when it was first publicly disclosed.

The number of people affected has not been stated.

Record overview

Incident date: Not confirmed
Discovery date: Not confirmed
Disclosure date: Not confirmed
Notification date: Not confirmed
Public record: 26 November 2025
People affected: Not stated
Who was affected: customers

Each date is either established by a quoted source or explicitly not confirmed. The public record date is when the incident was first publicly reported, not when it occurred.

Affected people and data

Categories of affected data

basic personal information
name
contact details

Notifications and response

Regulators notified

Not stated

Law enforcement notified

Not stated

Legal and formal response

Not stated

Technical and organisational remediation

Not stated

Official sources

Official notice

ASOS cyber attack: Australian and UK customers sent threatening message as retailer investigates data breach | The Nightly

thenightly.com.auRetrieved 7 October 2026

View official source

Further official sources

Corroborating report

London councils enact emergency plans after three hit by cyber-attack | Cybercrime | The Guardian

theguardian.comRetrieved 8 October 2026

View official source

Corroborating report

ASOS confirms cyber cover mid-breach as vendor gap questions mount | Insurance Business

insurancebusinessmag.comRetrieved 8 October 2026

View official source

Cleverer commentary

This section is commentary by Cleverer, not reporting, and is not drawn from the sources cited above.

Cleverer Insight

The record describes an investigation by ASOS after Australian and UK customers received a threatening message. ASOS stated that basic personal information, including names and contact details, may have been accessed. Customers are the recorded affected group, but the number of people affected and the incident type have not been publicly established in this record.

The incident and discovery dates, notification details, regulator or law-enforcement involvement, formal response and remediation are also not publicly established. The case illustrates the difficulty of assessing impact where an organisation has acknowledged possible access to personal information but the available public record does not establish the mechanism, scope or outcome of the event.

How Cleverer may have helped

For this kind of suspected access, current evidence of preparation, access controls, staff training, incident procedures, decision-making and communications may help an organisation investigate consistently and explain what is known, unknown and still being assessed. Clear governance and documentation could also make it easier to demonstrate how reasonable steps and notification decisions were considered.

Maintaining those records would not mean the incident was necessarily preventable, and it would not guarantee compliance or any particular security outcome. It may nevertheless support more reliable oversight and response as facts develop.