ShopbamTips and advice throughout the world of online shopping
Retail news · October 2026

ASOS has confirmed a data breach and H&M is checking hacking claims: what to do if you shop with either

A week after hackers used the ASOS app to push a threat to customers’ phones, ASOS has confirmed that names, delivery and email addresses, phone numbers and “certain non-personal account related information” were accessed — reportedly including what people searched for. On 12 October H&M said it was investigating claims of its own, but has “not found any indications” of a breach. Neither company says card details or passwords were taken. The real risk to you now is the scam message that knows your name, address and what you were shopping for.

Published 13 October 2026 · Followed up 13 October 2026 · Shopbam reports what other outlets and company filings recorded; we did not attend or audit anything ourselves.

A smartphone showing a warning notification beside an open padlock, a shopping bag and a parcel with a returns label

ASOS and H&M: the numbers that affect shoppers

FigureValueWhat it means
ASOS data accessed Names, delivery and email addresses, phone numbers ASOS statement of 8 October 2026, reported by the Irish Examiner and ITV News. Also “certain non-personal account related information”, which the Irish Examiner and ITV report includes recent search history.
ASOS data not accessed Payment cards and account passwords ASOS: “We do not believe that payment-card information or account passwords were impacted” (6 October, to Newsweek), repeated in its 8 October email.
ASOS customers affected Not published ASOS has not said. It has about 17 million customers worldwide (CityAM via Newsweek; ITV News). The NCSC tells every ASOS customer to assume they are affected.
Share of ASOS revenue from the UK 49% First half of its latest financial year, ITV News, 8 October 2026.
H&M data accessed None confirmed H&M, 12 October 2026: “we have not found any indications that our data environment has been compromised”. The ShinyHunters group claims a “limited scope” of H&M Group data (LBC).
H&M report to the ICO None made The ICO had received no report by Monday lunchtime (The Times, via TheIndustry.fashion). Beinsure says H&M did not notify because it found no evidence of a breach.
ASOS refund time Up to 10 working days After your return is processed, to the original card. Allow up to 10 calendar days for a parcel to reach the warehouse first (ASOS refunds help page, checked 13 October 2026).
Deadline for a subject access request One month, free Extendable by up to two further months for complex requests. It can be made verbally, in writing or on social media (ICO guide to subject access).
ICO helpline 0303 123 1113 The ICO says complaints needing detailed review are reaching a case officer “around 10 months after submission”. It cannot award compensation.
Report Fraud (formerly Action Fraud) 0300 123 2040 Report Fraud replaced Action Fraud on 4 December 2025 for England, Wales and Northern Ireland. In Scotland, call Police Scotland on 101.
Scam texts and emails 7726 and report@phishing.gov.uk Forward a scam text free to 7726, and a scam email to report@phishing.gov.uk (NCSC).
M&S customers’ 2025 “thank you” A packet of sweets, not cash A birthday treat (Percy Pigs or Swiss truffles) for over 1.8 million Sparks customers in July 2025, once Sparks returned after almost three months offline (Retail Gazette). We found no cash compensation offered to M&S customers.

What happened

On the morning of Tuesday 6 October 2026, ASOS app users in the UK received a push notification titled “ASOS HACKED”. It read: “Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it,” and carried a link to a Telegram channel (Newsweek). Cyber Daily reports the same message reached app users in Australia, France, Sweden and the Republic of Ireland. A group calling itself Xuanye claimed responsibility on Telegram.

Six days later, on Monday 12 October, The Times reported that a different group, ShinyHunters, was claiming to hold data from H&M. Retail Gazette called H&M the latest retailer to investigate a cyber attack. The two stories are being reported together, but they are not the same thing, and for a shopper the difference matters.

What ASOS has confirmed

ASOS's first statement, on 6 October, said it was “investigating unauthorised activity involving third-party platforms that we use to communicate with customers” and that it “took immediate action to restrict access to the notification platforms”. It said “basic personal information including name and contact details may have been accessed” and “we do not believe that payment-card information or account passwords were impacted” (Newsweek; Cyber Daily). Its website and app kept working.

On Thursday 8 October, after what the Irish Examiner calls a “detailed, 48-hour investigation”, ASOS emailed customers. “We discovered that an unauthorised party gained access to an Asos employee account by impersonating a trusted contact to obtain login credentials,” it said. “Those credentials were then used to access information on certain third-party platforms used by Asos.” The platforms were “immediately locked down”, and ASOS says it is “working with the relevant law enforcement and regulatory authorities”.

What was taken, per the Irish Examiner and ITV News: names, delivery and email addresses, phone numbers and “certain non-personal account related information”. Both outlets report that this includes recent search history in the app — ITV says “what customers have searched for”. ASOS's email says customers do not need to do anything to their account, and warns them to “remain cautious of unexpected messages or calls claiming to be from Asos”. It adds: “We will never ask you to share passwords, security codes or payment details through an unsolicited message or call.”

ASOS has not said how many customers are affected. It has about 17 million customers worldwide (CityAM, cited by Newsweek; ITV News), and the UK made up 49 per cent of its revenue in the first half of its latest year (ITV). The National Cyber Security Centre's page on the incident tells anyone who is an ASOS customer to assume they are affected, “even if they did not receive the notification”.

The hackers' claim that they “fully compromised the Snowflake instance” — a cloud database — has not been confirmed by ASOS and has not been independently verified (Beinsure; Insurance Business). ASOS's own account is narrower: an employee login and some third-party customer-messaging platforms. We are reporting ASOS's version as the confirmed one and the hackers' as a claim.

What H&M has said — and not said

H&M's statement, given to several outlets on 12 October, says it is “aware of information circulating online regarding a potential cyber security incident” and is “currently investigating the claims”. It adds: “At this time, we have not found any indications that our data environment has been compromised” (TheIndustry.fashion; Beinsure). LBC quotes a slightly different wording, referring to claims “involving a limited scope of H&M Group data” and saying H&M is investigating “to assess their validity”. We print both because we could not see the original.

H&M has not reported anything to the Information Commissioner's Office. The ICO had received no report by Monday lunchtime, according to The Times as cited by TheIndustry.fashion, and Beinsure says H&M did not notify because it found no evidence of a breach. UK rules require a reportable personal data breach to be notified within 72 hours of the company becoming aware of it. No outlet we read gives a volume or type of data for the H&M claim, and no report links the two groups behind the ASOS and H&M claims. H&M shares fell about 1.3 per cent (Beinsure) or 1.4 per cent (Insurance Business) in Stockholm on the day.

There is one relevant precedent. In August 2026 H&M told members in South Korea it had confirmed unauthorised access to customer information there, around 5 August. The data was “email addresses, phone numbers and order or return reference numbers”, and H&M said card details, payment information and passwords were not affected (Korea Herald, 14 August 2026). That was a separate, Korea-only incident. We mention it because it shows the kind of data retailers' customer systems hold — and a scammer who can quote your real order number is far more convincing than one who cannot.

The ICO: what ASOS has to do, and what you can do

On 6 October the ICO told MLex it had received no report from ASOS “at this stage”, noting that not every incident has to be reported. ASOS says it is working with regulators but has not named them, and we could not find an ICO statement since. That is ASOS's obligation, not yours. Yours are rights.

Under UK GDPR you can ask any company what personal data it holds about you, with a subject access request. The ICO says the company must reply “without undue delay and at the latest within one month”, extendable by up to two further months for complex requests. It is free in most cases, and a request can be made “verbally or in writing, including via social media”. You do not need special wording.

If you are unhappy with how a company handled your data, complain to it first. The ICO's complaint form asks for a copy of that complaint. The ICO's number is 0303 123 1113, but be realistic: its own page says complaints needing detailed review are reaching a case officer “around 10 months after submission”, and “the ICO can't award compensation”. Which? says compensation for financial loss or distress is claimed from the company, and through the small claims court if it refuses, where an ICO finding is useful evidence.

What M&S, Co-op and Harrods customers actually got in 2025

The M&S attack was first reported on 22 April 2025, and online orders were paused from 25 April for about six weeks. On 13 May M&S confirmed personal data had been taken: Which? lists contact details, dates of birth and online order histories, but no passwords and no usable card details. M&S said customers need take no action and would be “prompted to reset their password the next time they visit or log onto their M&S account” (Grocery Gazette). The cost to M&S was reported as £324m in lost sales, against a reported £100m insurance payout (Insurance Business).

What M&S customers received, when Sparks came back in July 2025 after almost three months offline, was a birthday treat — Percy Pigs or a Swiss truffle box — for over 1.8 million customers, and the return of coffee stamps (Retail Gazette). M&S called it “a small gesture to say thank you”. We found no cash compensation. Co-op, which confirmed that all 6.5 million members had their data stolen (Hargreaves Lansdown), gave members £10 off a £40 in-store shop for one week from 18 June 2025 (Grocery Gazette). Harrods began telling about 430,000 customers in September 2025 that names, contact details and possibly marketing data had been taken from a third-party supplier (The Register). In each case, the practical help for customers was a warning about scams. Expect the same this time.

How it unfolded

DateWhat happened
22 April 2025M&S cyber attack first reported. Online orders pause from 25 April for about six weeks.
April to May 2025Co-op attacked. In July it confirms all 6.5 million members’ data was stolen.
13 May 2025M&S confirms customer contact details, dates of birth and online order histories were taken; customers prompted to reset passwords.
18 June 2025Co-op gives members £10 off a £40 in-store shop for one week.
July 2025M&S restores Sparks with birthday treats for over 1.8 million customers.
26 September 2025Harrods starts telling about 430,000 customers their details were taken from a third-party supplier.
4 December 2025Report Fraud replaces Action Fraud.
About 5 August 2026H&M confirms unauthorised access to some customers’ data in South Korea: emails, phone numbers and order or return reference numbers.
6 October 2026ASOS app users receive a push notification titled “ASOS HACKED”. ASOS confirms unauthorised activity; the NCSC tells all ASOS customers to assume they are affected.
8 October 2026After a 48-hour investigation ASOS emails customers: an employee was tricked into handing over log-in details, and names, addresses, phone numbers and account information were accessed.
12 October 2026The Times reports ShinyHunters claims against H&M. H&M says it is investigating and has found no sign of a breach.

What this means if you shop there

  • If you have ever shopped with ASOS, assume your name, address, phone number and recent searches are out there. That is the NCSC's advice, whether or not you got the push notification. ASOS has not said how many people are affected. For H&M, nothing has been confirmed — H&M says it has found no sign of a breach.
  • You do not need to change your ASOS password because of this — but change it anywhere else you used it. ASOS says passwords were not accessed. The NCSC still recommends a passkey, or a strong, separate password with two-step verification, and a password reused across sites is the easiest way into an account that holds a saved card or a voucher balance.
  • Expect scams that know what you were shopping for. The stolen data is exactly what makes a fake “ASOS delivery problem”, “refund due” or “compensation for the hack” message look real. ASOS says it “will never ask you to share passwords, security codes or payment details through an unsolicited message or call”. Do not click a link in a message or push notification; open the app or type the web address yourself. Forward scam texts to 7726 and scam emails to report@phishing.gov.uk.
  • Orders, returns and refunds carry on as normal. ASOS says its website and app were unaffected throughout. Its refunds page says money goes back to the original card, up to 10 working days after a return is processed, with up to 10 calendar days for the parcel to reach the warehouse. Neither company has announced any change to orders, returns or refunds.
  • Gift cards and loyalty points: nobody has said they are at risk, and nobody has said they are not. Neither ASOS's nor H&M's statements mention vouchers, gift cards or loyalty points. ASOS's refunds page says a voucher-paid refund goes straight back to your ASOS account and a replacement voucher keeps the original expiry date. The safe move is to check your balance in the app now so you would notice a change.
  • Ask what they hold — it is free and they have a month. Under UK GDPR you can make a subject access request to ASOS or H&M by email, letter or social media. If you are unhappy with the answer, complain to the company first, then to the ICO on 0303 123 1113. The ICO cannot award compensation; that is a claim against the company, and the small claims court if it refuses.
  • If you lose money, report it the same day. Ring your bank first, then Report Fraud on 0300 123 2040 (it replaced Action Fraud in December 2025) or Police Scotland on 101.
  • Do not hold out for compensation. After the 2025 attacks, M&S Sparks customers got a birthday bag of Percy Pigs or truffles and Co-op members got £10 off a £40 shop for a week. We found no cash payment to customers from either.

Checked on 13 October 2026. A story this recent moves — we update this box rather than leaving it to rot.

Where this came from

What we could not check

  • How many ASOS customers are affected. ASOS has not said, and neither has the group that claimed the attack.
  • Whether search history really was taken. ASOS's own wording is “certain non-personal account related information”; the search history detail comes from the Irish Examiner and ITV News, which say it is “understood” to be included.
  • Whether the hackers reached ASOS's Snowflake database, as they claim. ASOS has not confirmed it and no outlet we read has verified it.
  • Whether ASOS has now reported to the ICO. The ICO said on 6 October it had no report “at this stage”; we found no later ICO statement.
  • What, if anything, ShinyHunters holds from H&M. No outlet gives a volume, data type or country, and we could not open The Times original.
  • H&M's exact statement. TheIndustry.fashion and Beinsure quote “information circulating online”; LBC quotes “claims circulating online” and “a limited scope of H&M Group data”.
  • H&M UK gift card and H&M Member terms. Our searches returned only the Irish, Australian and Canadian pages, so we have not described the UK rules.
  • Whether ASOS vouchers, gift card balances or saved payment methods were touched. No ASOS statement mentions them either way.
  • A July 2026 ASOS account takeover reported by trackers at 138,800 (Breach History, via Newsweek) or 138,828 (eSecurityPlanet) accounts. ASOS has not confirmed it, and we did not open either tracker.
  • Co-op's member numbers. Hargreaves Lansdown reports all 6.5 million members' data stolen; Which? reported data from 20 million past and current members. We print both.
  • Retail Gazette's own H&M, ASOS update and “industry reacts” pages and Drapers would not open for us; we relied on other outlets reporting the same statements.

Company figures are as reported by the businesses themselves or their administrators. Where two sources disagree, this page says so rather than picking one.