ASOS data hack: What customers should do to protect themselves

ASOS customers should be on their guard against scams after an unauthorised message was sent through the retailer's customer notification system.

Some shoppers with the online shopping retailer received unauthorised notifications this week.

ASOS said basic personal information, including names and contact details, may have been accessed, although it does not believe payment-card information or account passwords were affected.

The retailer is now investigating what happened.

But customers have been warned to be particularly careful about emails, texts and other messages claiming to be from the fashion retailer following a cyber incident.

The UK's National Cyber Security Centre (NCSC) has advised ASOS customers to assume they are affected, even if they did not receive the unauthorised notification.

Don't click on links

Some Asos customers received an alarming notification that appeared to reference a hack at the company and contained a link.

Do not click the link or follow instructions contained in the message.

You should not click on suspicious or strange links in messages, even when they appear to come from a company they know.

If you have already clicked the link but haven't entered any information, downloaded anything or installed software, the NCSC says it is unlikely you need to take further action, but you should remain alert for unusual activity.

Be extra careful with emails and texts claiming to be from ASOS

A cyber incident can give criminals an opportunity to send convincing follow-up phishing messages.

If names and contact details have been accessed, scammers could potentially use that information to make fake messages appear more credible.

For example, you could receive an email or text that looks genuine claiming that:

• your ASOS account has been compromised

• you need to reset your password

• your order has been cancelled

• your delivery has been delayed

• you need to confirm your address

• you are entitled to a refund

• your payment has failed

• you need to verify your identity.

The messages fit the narrative around the hack but could be scammers.

Instead, open the ASOS website or app yourself using the normal method.

The NCSC recommends contacting an organisation directly if you are unsure whether a message is genuine, using contact details from its official website rather than those contained in the message.

Change your password

ASOS says it does not believe account passwords were affected by the incident.

However, it is still worth updating log-ins.

If you use the same password for other accounts, change those too.

Choose strong, separate passwords for each account, along with two-step verification where available.

That means your ASOS password should be unique and not used for your email, banking, social media or other shopping accounts.

Turn on two-step verification where you can

Two-step verification, also known as two-factor authentication or 2FA, adds another layer of security to an account.

Even if criminals obtain a password, they may still be unable to access the account without the additional verification step.

Using passkeys, or strong, separate passwords combined with two-step verification, helps protect accounts even if personal information is exposed in a data breach.

Check your ASOS account for anything unusual

It's a good idea to log in to your Asos account and look out for anything you don't recognise, such as orders you didn't make or changes to your delivery address or account details.

If you spot anything suspicious, secure the account and contact ASOS through its official channels.

Report suspicious messages

If you receive a suspicious email claiming to be from ASOS, you can forward it to report@phishing.gov.uk.

Suspicious text messages can be forwarded to 7726, a free service that allows your mobile provider to investigate scam texts.

If you've lost money or provided banking details to a scammer, contact your bank immediately and report the fraud.