Listen again · In Conversation
Asos data breach exposed more customer information than first reported October 9, 2026 · 4:24 · Technology and AI · With Maya and Leo
We’re looking at the Asos data breach and what the company says was accessed. The news developed over several days.
Transcript Tap a sentence to hear it from there.
Maya This is Slow English FM, with an interview on technology and digital life. Welcome. I’m Maya, and Leo covers technology for us. We’re looking at the Asos data breach and what the company says was accessed. Maya The news developed over several days. On October 6, Asos customers received an unauthorized app notification saying the company had been hacked. Asos said at first that basic personal information might have been accessed. The Guardian reports that Asos later said hackers had accessed a wider range of customer information. What does the company now say was involved? Leo The Guardian reports that Asos said the information included customers’ names, delivery and email addresses, phone numbers, and some recent search histories. The company said the information was stored on platforms it used, including a database held by an outside service provider. So the reported breach was not limited to basic contact details. Maya The BBC also reported that more information was exposed than first revealed. Can you explain how the attackers got access, according to Asos? Leo Asos said an attacker pretended to be a trusted contact and obtained an employee’s login details. The company said those details were then used to access information on third-party platforms. In simple terms, the attacker reportedly used a false identity to get someone’s account details, then used those details to reach information held elsewhere. Maya That suggests a security problem involving both an employee account and outside platforms. Does that mean the attackers had access to everything in Asos’s systems? Leo We should not assume that. The details reported are about information on the affected platforms. Asos said it had locked down those platforms. TechCrunch also reported that the attackers sent customers a rogue app notification, which said the company’s cloud storage had been fully compromised. That was the hackers’ claim in the notification; it is not the same as an independent finding that all of Asos’s cloud storage was accessed. Maya That distinction matters: the notification made a broad claim, while the company’s account describes specific information and platforms. What has Asos said about payment details and passwords? Leo The Guardian reports that Asos said payment card details and passwords were not accessed. The company also said its website and app remained safe to use, and that customers did not need to take action. Those are Asos’s statements about its own systems and response. Maya The company also warned customers to be careful. What should people watch for, based on that advice? Leo Asos warned customers to be cautious of unexpected calls or messages claiming to come from the company. That is especially relevant here because Asos says the attacker first impersonated a trusted contact to obtain an employee’s login details. Maya Asos said it was working with law enforcement and regulatory authorities. The Guardian also reported that the UK National Cyber Security Centre offered assistance after the unauthorized notification. What is the main point for customers? Leo The main point is to separate what Asos says was accessed from the much broader claim in the rogue notification. Asos says certain contact details and some search histories were accessed, but that payment card details and passwords were not. The company says customers do not need to take action, while also advising caution around unexpected calls or messages. Those statements give customers a clearer account of the reported risk, but they remain the company’s account. Maya That’s our look at the Asos breach. Thanks for listening to Slow English FM.
