Products Lemma APIProof issuance & verification platformTrust402Delegate to agents, and transactSealSign-in for the agent era — no keys handed over
Use cases Manufacturing & Critical InfraInspection Record AssuranceFinance & FinTechCounterparty Record VerificationPublic SectorCertificate-less ProceduresHealthcareQualified Worker AssuranceProcurement & Supply ChainSupplier Credential MonitoringMedia & ContentContent AuthenticityService & RetailCross-group IdentityAI Adoption (cross-industry)AI Run GovernanceDevelopers & Agent OpsAgent Authority Control ▸ Browse the use-case index
Pricing
Resources Critical BriefThe frontier of AI × trustBlogThinking and implementation notesDocumentationAPI & specsVerification CenterReal verification & issuance countsAbout usFRAME00, Inc.ContactSales & press inquiriesGlossaryDefinitionsFAQFrequently asked questions
Get Started ↗ JA
Home / Critical Brief / No. 156
No. 156 Critical Brief · Verifiable Origin

ASOS: The attacker's message reached customers as an official app notification (company disclosure)

No layer is visible that checks a mass notification against an approved send before it goes out

Allcustomers told to assume impact
The UK National Cyber Security Centre (NCSC) advised every ASOS customer to assume they are affected, even without receiving the notification. How many received it, and how many were affected, has not been disclosed
~10:00
On October 6, when the unauthorised notification was sent to customers (per ASOS)
10-06→10-08
From the unauthorised notification to ASOS explaining the route to customers (per press reports)
CountryUK
Incident date2026-10-06
Published2026-10-23
AuthorsLemma Critical Team
Contents
  1. 01TL;DR
  2. 02What happened
  3. 03Timeline — disclosure and response
  4. 04Why it wasn’t stopped
  5. 05How to counter this
  6. 06Sources

TL;DR

  1. 01What happened

    On October 6, 2026, UK fashion retailer ASOS disclosed that an unauthorised notification had been sent to customers at around 10am that day. It said it was investigating unauthorised activity involving outside platforms it uses to communicate with customers, and that names and contact details may have been accessed. The notification was titled “Asos hacked” and linked to the Telegram messaging service (per press reports).

  2. 02What is known

    On October 8, ASOS told customers that an attacker had impersonated a trusted contact to obtain an employee’s login, then used it to access information on third-party platforms (per press reports). How that login relates to the sending of the notification has not been disclosed.

  3. 03The missing layer

    ASOS said it immediately restricted access to the notification platforms, but the notification had already reached customers. What failed was the layer that checks a mass customer notification against an approved send before it goes out.

What happened

The company
ASOS, a UK online fashion retailer.
What happened
At around 10am on October 6, an unauthorised notification was sent to ASOS customers. ASOS said it was investigating unauthorised activity involving outside platforms it uses to communicate with customers (ASOS disclosure). The UK National Cyber Security Centre (NCSC) said some customers received a push notification from ASOS, and advised all ASOS customers to assume they are affected even if they did not receive it.
The notification
Titled “Asos hacked”, with a link to Telegram (per press reports). How many received it has not been disclosed; press reports said thousands.
The route
Per ASOS’s October 8 explanation, an unauthorised party impersonated a trusted contact to obtain login credentials, gained access to an employee account, and used those credentials to access information on third-party platforms ASOS uses (ASOS’s explanation to customers, as quoted in press reports).
Not disclosed
Whether those platforms are the ones that sent the notification, whether the login was used to send it, which employee and what rights, whether MFA was used, when access began, and how many customers’ data was involved. ASOS has not named the platform.
Data accessed
On October 6 ASOS said basic personal information such as names and contact details may have been accessed, and that it did not believe payment-card information or passwords were affected. The NCSC said ASOS had stated names and contact details had been accessed. ASOS’s October 8 explanation listed names, delivery and email addresses, phone numbers and some non-personal account information (per press reports); the latter is understood to include search history (per press reports).

Glossary
ASOS — A UK online fashion retailer, listed on the London Stock Exchange.
Push notification — A short message that arrives on a smartphone under an app's name. It is usually sent through an outside delivery service.
Outside delivery service — An outside service a company uses to send email and app notifications to customers. ASOS has not said which service was involved.

Exhibit 1The sequence, as disclosed

The stopping point is ③. Had mass customer notifications been checked against an approved send before going out, an unapproved one would not reach customers. Whether the login in ① ② was used for ③, and the order of ③ and ④, have not been disclosed.

Attacker
1
Impersonates a trusted contact and obtains an employee's login

ASOS's October 8 explanation (per press).

Attacker
2
Uses it to access information on third-party platforms

Whether these sent the notification is not disclosed.

Attacker
3
The attacker's message goes to customers as an official app notification

Around 10am, October 6.

Attacker
4
Accesses names, contact details and more

Payment cards and passwords said to be unaffected.

ASOS
5
Restricts access to the notification platforms

When it noticed is not disclosed.

Timeline — disclosure and response

  • Around 10am, an unauthorised notification goes to customers. ASOS makes a disclosure. The NCSC publishes advice for customers. ASOS later apologises to customers directly and asks them not to click the link (per press).
  • The UK Information Commissioner’s Office (ICO) issues a statement urging caution with links in such messages.
  • After a 48-hour investigation, ASOS explains the route and the data accessed to customers (per press).

The unauthorised notification, the unauthorised activity on outside platforms, and the data that may have been accessed rest on ASOS’s disclosure and the NCSC advice (both primary). The route and the data described on October 8 come from ASOS’s explanation to customers as reported in the press; they are not in ASOS’s disclosure.

After disclosure

  • ASOS: Restricted access to the notification platforms immediately and is working with internal and external advisers and authorities. It holds cyber and business continuity insurance and said it is too early to quantify the impact on trading. Its October 8 explanation said affected platforms were locked down and security controls further strengthened (per press).
  • NCSC and ICO: Urged customers not to click links in notifications or emails. The ICO advised that anyone changing a password do it through the official site or app.

Why it wasn’t stopped

The question here is not only how the employee login was protected. A notification went out in bulk under the official app’s name from an outside service used for customer contact, and the disclosures show no step checking it against an approved send before it went out.

The core of this case
A notification went out in bulk under the official app's name from an outside service used for customer contact. The disclosures show no step checking it against an approved send before it went out.
Exhibit 2The detection–proof gap

Proof here means checking, before a mass customer notification goes out, "is this on the company's schedule of approved sends?", and recording it. Detection means noticing unauthorised activity and stopping it.

Proof layer · not visibleBefore sending, check it is an approved send
The gapThe attacker's message
reached customers
Detection layer · workedRestricts access to the platforms
STEP 1
Login taken
STEP 2
10-06 notification arrives
STEP 3
Access restricted
STEP 4
10-06 disclosure

Detection worked: ASOS restricted access and disclosed the same day, but the notification had already reached customers. “Can be sent from the outside delivery service” and “this send is approved” are separate facts, and the disclosures show no layer checking the first against the second. That distance is the detection–proof gap, and it is a structural one.

The same structure appears in Yumirlink’s Cuenote FC (an email delivery provider’s staff credentials were taken).

How to counter this

Send mass customer notifications only when they match the company’s schedule of approved sends. Then a stolen login to the delivery service alone cannot get an unapproved notification to customers. This is not a substitute for detection; it sits in front of it.

Industries and operations to watch

IndustryServices & retail
E-commerce and retail that reach customers directly by app notification and email. The sender shows as the official name.
OperationSending & delivery
Mass notifications and email from outside services used for marketing and customer contact.
OperationAccounts & permissions
Employee accounts that can enter delivery services, and how their logins are protected.

Do today’s controls close it?

ControlThis caseWhy
Staff trainingPartialTraining alone cannot fully stop someone posing as a trusted contact.
MFAPartialASOS has not said whether it was used. In general it guards the login, but not what is sent after.
Restricting accessPartialIt worked after the fact. The notification had already arrived.
Warnings to customersPartialThey reduce harm after arrival, but don’t stop arrival.
ControlsWhat is needed
  1. Separate the right to send mass notifications from the right to write them. Whoever can write a notification should not be able to send it to every customer on their own.
  2. Send only what matches an approved send. Do not send mass notifications that are not tied to a scheduled, approved send, even with a valid login.
  3. Record who sent what under which approval, separately from the delivery service. Keep it in a form that can be checked later: in other words, as proof.
CheckChecklist

Three things to confirm in your organisation about customer delivery services

  • Can the person who writes a mass notification or email also send it alone?
  • Do logins to delivery services require phishing-resistant MFA?
  • When someone claiming to be a colleague or partner asks for login details, is there a step to confirm through another channel?

Note: if the approver’s account is also taken over, this check can be passed. It also stops sending, not the reading of customer data held in the service. How the notification was sent has not been disclosed. If follow-up reports reveal it, this Brief will be revised.

Sources

  1. Primary, disclosureASOS “Update regarding cyber incident”2026-10-06 · https://www.investegate.co.uk/announcement/rns/asos—asc/update-regarding-cyber-incident-/9809595
  2. Primary, public advisoryUK NCSC “Incident affecting ASOS customers”2026-10-06 · ncsc.gov.uk/news/incident-affecting-asos-customers
  3. Primary, statementUK ICO “ASOS statement”2026-10-07 · ico.org.uk/about-the-ico/…
2 more (reporting, analysis)
  1. PressThe Guardian “Asos warns customer data may be compromised after ‘unauthorised’ app access”2026-10-06 · theguardian.com/business/…
  2. Press, quoting ASOS’s explanation to customersThe Guardian “Asos says customers’ names, contact details and search histories hacked”2026-10-08 · theguardian.com/business/…

References: “The last layer left in AI-era cyber defense”

The same method elsewhereSee all 15 "Sending & delivery" cases Get new cases and checks like these by email

This material is a structured analysis of public information; it is not an audit, diagnosis, or recommendation for any specific organization.

Cite this Brief

Lemma Critical Team. (2026).
"ASOS: The attacker's message reached customers as an official app notification (company disclosure) — No layer is visible that checks a mass notification against an approved send before it goes out".
Lemma Critical Brief No.156. Lemma / FRAME00, Inc.
https://lemma.frame00.com/critical/briefs/156-asos-employee-impersonation-rogue-push/
Lemma

If it can't be verified,
it doesn't enter your operation.

Lemma attaches cryptographic proofs to data and AI execution, so the receiving side can confirm authenticity without asking the issuer. Detection stays; a proof layer is added in front of it.

Talk to enterprise See the verification center