What Local Businesses Can Learn From the ASOS Customer Data Hack

A customer-data incident needs one clear, reliable source of information

Reports about ASOS provide a timely reminder that when customers receive worrying messages about their data, they need a way to tell what is real. The BBC reported on concern surrounding the ASOS hack, while The Guardian reported that ASOS customers received messages threatening to leak personal data. The reporting created understandable questions about whether personal information was affected and how the company was communicating.

For a local business, the immediate lesson is not that every suspicious message means your systems were breached. It is that customers may look to your website, inbox, phone line, or social accounts for clarification if an incident affects an online account, booking platform, payment tool, or contact form.

A short, factual website notice can help customers find legitimate updates without forcing your team to answer the same uncertain question across multiple channels. It can also reduce the risk of well-meaning staff giving inconsistent information while facts are still being investigated.

This is not legal advice. Notification requirements vary by location and by the details of an incident. If customer information may have been exposed, involve qualified legal counsel, your insurer, incident-response specialists, and relevant authorities as appropriate.

In this article

• What the ASOS reporting does — and does not — establish
• What to confirm before publishing a website notice
• What a useful customer update page should say
• How to handle calls, forms, email, and social messages during an investigation
• A copy-ready structure for an incident update

Start with verified facts, not assumptions

The first public statement matters because customers, journalists, vendors, and scammers may repeat it. Resist the urge to fill information gaps with guesses.

Before posting an update, establish a small internal fact sheet that separates confirmed information from open questions.

Confirm these points first

Use careful terms. “We are investigating a security incident involving [system]” means something different from “customer data was exposed.” If you do not know whether data was accessed, say so plainly.

That distinction is especially important when customers have received threatening or suspicious messages. Unverified attacker claims are not the same as confirmed findings.

For background on the reported ASOS situation, see the BBC’s report and The Guardian’s coverage.

Create one update page customers can verify

If a customer hears about a possible incident through a text, email, social post, or word of mouth, they need an official destination they can reach independently.

Create a dedicated page on your own domain, such as:

yourbusiness.com/customer-update

Use this page as the source of truth for every other channel. Your email, Google Business Profile post, social post, voicemail message, and support replies should point to the same URL.

What the update page should include

1. A direct headline

Avoid vague headlines such as “Important information” or “A message from our team.”

Use a descriptive title:

Update regarding a security incident affecting our online booking system

Customers should know what the page concerns before they click.

2. The date and time of the latest update

Place this near the top:

Last updated: October 6, 2026, 2:30 p.m. local time

A visible timestamp helps customers distinguish a current notice from an old one that may be circulating again.

3. Only confirmed scope

State the system involved and the relevant dates only when those details are verified.

For example:

We are investigating suspicious activity involving our online contact form between [date] and [date]. Our investigation is ongoing. At this time, we have not confirmed whether submitted information was accessed.

This is more useful than a generic statement that your business “takes privacy seriously.” Customers need to understand the situation, not read a brand statement.

4. Clear steps for customers

The appropriate advice depends on what is actually known. Keep it relevant and do not tell people to take actions that do not match the incident.

Depending on confirmed facts, your update might direct customers to:

• Visit the update page directly by typing your website address into their browser.
• Be cautious of messages claiming to be from your business that request passwords, payment details, or one-time codes.
• Use the verified contact route listed on your site if they have a question.
• Follow instructions from their bank, account provider, or other trusted provider if they believe an account has been compromised.

Do not ask customers to submit sensitive documents, passwords, payment-card numbers, or full account credentials through a crisis form.

5. A legitimate contact route

Give people one route that your team can monitor: a named support email address, a phone number, or a contact page.

If you use a form, ask only for the minimum details required to respond. For example, a name, email address, and a short description of the concern may be enough. Avoid creating a form that asks customers to paste suspicious messages containing personal details unless your incident-response team specifically needs that information and has approved the process.

Review your usual form setup as well. The principles in our local business lead form privacy checklist can help you identify fields that collect more than your team needs.

Keep every channel aligned

A website notice is most useful when it matches what customers hear elsewhere. Inconsistent messages can create more concern and make impersonation attempts harder to spot.

Prepare a short approved message for the people who answer your phone, inbox, social messages, and front desk questions.

A simple channel plan

Do not publish different versions of the facts to different channels. If new information changes your understanding, update the website page first, add a new timestamp, and then update channel posts or replies.

Make your official messages easy to recognize

Tell customers what you will not ask for. For example:

We will not ask for your password, payment-card number, or one-time verification code by email, text message, or social media.

This does not eliminate scams, but it gives customers a simple way to assess a suspicious message.

Use links to pages on your own domain rather than sending customers to an unfamiliar URL. If possible, avoid asking them to reply directly to an email about the incident; customers may have difficulty telling an authentic message from an impersonation attempt.

Prepare for confused and suspicious inquiries

The ASOS reporting does not document a lead surge or a measurable increase in local-business inquiries. Still, a business should prepare for the possibility that customers will contact it through forms, calls, emails, and social messages if they are concerned about an incident.

Treat this as a customer-support and privacy issue, not a sales opportunity.

Designate one owner for incident-related messages

Choose a specific person or small team to receive escalated questions. Everyone else should know where to send:

• Customers who believe they received a suspicious message
• People asking whether their account or submission was affected
• Requests from vendors or partners
• Media or legal inquiries
• Reports that your website, form, or booking process is behaving unusually

A clear handoff avoids accidental promises, contradictory answers, or unnecessary sharing of investigative details.

Use a short response script

Your staff do not need to diagnose an incident in real time. Give them language that keeps the customer safe and directs them to the current information.

Thanks for contacting us. We understand your concern. Our latest verified information is available at [official URL]. Please do not send passwords, payment details, or verification codes by email or message. If you need help with [specific service or account issue], contact us through [verified route].

Keep the script current as facts change.

Monitor form submissions without expanding data collection

During an investigation, review incoming messages for patterns:

• Are customers receiving similar suspicious emails or texts?
• Are certain site forms generating unusual spam or unexpected attachments?
• Are customers having trouble identifying the official update page?
• Are messages arriving outside normal channels, such as social media direct messages?

Document what you need for your response team, but do not turn your contact form into an evidence-collection system. Collecting extra personal information may create another risk while the scope of the incident is unknown.

For a broader review of contact-page setup, see 7 contact page mistakes that cost local businesses leads.

A practical website-notice template

Use this structure as a starting point, then replace every bracketed item with verified information. Remove any section that does not apply.

Update regarding [system or service]
Last updated: [date and time]

We are investigating [brief, factual description of the incident] involving [affected system].

The activity occurred or may have occurred between [confirmed dates, if known]. At this time, we have confirmed [only confirmed facts]. We are still investigating [unresolved point, if appropriate].

Customers should [relevant, proportionate action]. Please be cautious of messages claiming to be from us that request passwords, payment information, or verification codes. We will not request that information through email, text message, or social media.

We will update this page as confirmed information becomes available. If you have questions, contact us at [verified email address, phone number, or contact-page URL].

We are working with [qualified advisers, insurer, incident-response specialists, or authorities, if confirmed and appropriate].

Before publishing, ask three questions:

1. Can we support every factual sentence?
2. Does the notice tell customers exactly where to find future updates?
3. Does it avoid asking for sensitive information or revealing details that could worsen the incident?

Do not let the notice become stale

An update page should not silently disappear once the immediate concern quiets down. Keep a dated record of meaningful changes, even if the update is simply that the investigation remains ongoing.

When the matter is resolved, publish a final update that explains what is now known, what you did, and where customers can direct any remaining questions. Do not erase the original context in a way that makes old emails or social posts look suspicious.

Your regular website security practices also matter before an incident occurs. Review who can access website accounts and where passwords are stored. Our guide to avoiding password exposure in shared Google Docs is a practical place to start.

Make your website easier to manage when communication matters

A customer-data concern is a poor time to discover that no one can update your website, locate the contact-form inbox, or confirm which page is official.

StoopCraft builds websites for local businesses and includes on-page SEO as part of its $99/month service. If you want a clearer, professionally managed website foundation for customer updates and everyday inquiries, visit StoopCraft.

Related reading

• What Local Businesses Should Learn From Revolut’s Fake Government Data Requests
• What Local Businesses Can Learn From the OpenAI–Hugging Face AI Agent Hack
• Cybersecurity Awareness Month Checklist for Local Business Websites
• How to Create a Local Business Website FAQ Page That Helps Customers Take the Next Step