ASOS Reports Unauthorized Push Notification Leak Exposing Customer Names and Contact Details
What Happened — On 6 October 2026 ASOS sent an unauthorized push notification to a subset of its customers. The company’s investigation indicates that basic personal information—including names and contact details—may have been accessed. ASOS does not believe payment‑card data or account passwords were compromised.
Why It Matters for Trust & Control Assurance
- The incident highlights a gap in access‑control enforcement and real‑time monitoring of customer‑facing communication channels.
- Continuous control‑assurance programs require auditable evidence that only authorized systems and personnel can trigger notifications or read personal data.
- Demonstrating robust identity‑access governance and logging is essential for defending against similar data‑exposure events and for providing a defensible audit trail.
Who Is Affected – Retail‑e‑commerce customers of ASOS (global consumer base).
Recommended Actions –
- Verify whether any of your customers received the unauthorized notification.
- Review and tighten access controls on push‑notification services and related APIs.
- Enable comprehensive logging and real‑time alerting for any access to personal‑data stores.
- Collect and retain evidence of access‑control policies for audit readiness.
- Communicate clear guidance to customers on spotting phishing attempts.
Source: NCSC UK – Incident affecting ASOS customers
Technical Notes – The breach appears to stem from a misconfiguration or compromised credential that allowed an unauthenticated actor to trigger a push notification and read limited customer records. No specific CVE was disclosed. Source: same as above