ASOS Data Incident: What the NCSC Notice Means

ASOS has said it is investigating a cyber incident. Some customer personal information, including names and contact details, may have been accessed. On Tuesday 6th October, some ASOS customers received an unauthorised push notification. ASOS says it does not believe payment card information or account passwords were affected. The National Cyber Security Centre (NCSC) has published guidance for anyone who shops with ASOS.

What this actually means for you

If you have an ASOS account, the NCSC's advice is straightforward: assume you could be affected, whether or not you personally received the unauthorised notification. Names and contact details are enough for someone to build a convincing scam message. They are not enough, on their own, to get into your account or take your money. That is the distinction worth holding onto here. This is not (as far as is currently known) a payment card or password breach. It is a breach of the kind of information that makes phishing messages look personal and believable.

The real risk now is not the incident itself. It is what comes after it. The NCSC specifically warns that follow-on scam messages can arrive some time after a data breach, not necessarily straight away. So the thing to watch for is not just today's inbox, but messages over the coming weeks that mention ASOS, reference an order, or ask you to "verify your account".

What to do now

• Don't click links in any ASOS push notification, email or text you weren't expecting, even if it looks official. Go to the ASOS app or website directly instead.
• Check your ASOS account activity for anything you don't recognise, including recent logins or orders.
• Change your ASOS password as a precaution. ASOS says passwords weren't affected, but a fresh, unique password costs you two minutes and removes one more thing to worry about.
• Turn on two-step verification on your ASOS account if it's offered. This means a password alone isn't enough to get in.
• Be sceptical of urgency. A message that pushes you to act immediately, click now, or confirm details urgently is a classic scam pattern, breach or no breach.
• If you think you've been targeted by fraud, report it through the UK's Stop! Think Fraud service.

If an odd message does land, you don't have to guess whether it's genuine. Veystrix's free scam checker at /tools/scam will look at the wording and flag common scam patterns. If a message contains a link and you're not sure whether to open it, /tools/url checks where it actually leads without you having to visit it.

It's also a reasonable moment to check whether any of your passwords, not just your ASOS one, have shown up in previous breaches. Veystrix's /tools/password tool checks a password against known breach data, entirely in your browser, so the password itself never leaves your device.

What this does not fix

It's worth being honest about the limits here, because a VPN is not the tool for this particular job. A VPN hides your internet traffic and location from your internet provider and from networks you connect to. It does not stop a company's servers being accessed, it does not stop a phishing email reaching your inbox, and it does not protect an account that uses a weak or reused password. None of that is what happened here, and none of it is what a VPN addresses.

What actually matters after an incident like this is behavioural: not clicking suspicious links, not reusing passwords across sites, and treating unexpected urgent messages with a bit of scepticism. No single tool, VPN included, replaces that. What tools can do is make the checking quicker and remove some of the guesswork, which is what the free Veystrix tools above are for.

For general guidance beyond this specific incident, the NCSC's advice pages on data breaches, phishing, passkeys and staying secure online are worth a look, particularly if you want to understand how these incidents tend to play out over the following weeks.