ASOS Hack Lessons for Local Retailers: What to Update on Your Website After a Suspected Breach
A practical website communication checklist for local retailers responding to a suspected hack or suspicious customer messages.
A suspected breach calls for clear communication, not speculation
Reports from Sky News and the BBC said ASOS customers received threatening or unusual notifications in an apparent hack or breach. The reporting also made clear that the scope of the incident was uncertain.
For a local retailer, the immediate website job after suspicious customer messages, account activity, or a possible compromised communication channel is not to diagnose the incident in public. It is to give customers one reliable place to find verified updates and safe next steps.
A concise website notice can help reduce confusion if customer questions rise. It cannot confirm what happened, resolve a security issue, or replace guidance from qualified security, legal, or payment-provider professionals.
This checklist focuses on what a retailer can update on its public website while facts are still being verified.
Contents
- Publish a temporary, factual website notice
- Give customers a safe way to verify messages
- Route support questions without collecting more sensitive information
- Review payment, account, and order guidance
- Monitor lead forms and contact channels
- Create an update process before questions pile up
- Use a short, careful website notice template
- What not to publish
- A practical post-incident website follow-up
Publish a temporary, factual website notice
If a retailer has reason to believe customer communications may be affected, add a temporary notice where customers can find it quickly:
- At the top of the homepage
- On the contact page
- In the website footer, if the issue affects multiple pages
- On the account-login or order-tracking page, if those areas are relevant
- In a dedicated update page linked from the notice
The notice should state only what the business has verified. Avoid terms such as “data breach,” “attack,” or “customer data was exposed” unless qualified professionals or authoritative evidence have confirmed those facts.
A useful first notice usually includes four parts:
- What customers may have noticed For example: unusual messages appearing to come from the business.
- What the business is doing Keep this high-level: reviewing the situation and sharing verified updates on this page.
- What customers should do now Direct them to use the official website, official phone number, or known customer-support channel.
- Where the next update will appear Give customers one URL to check rather than leaving them to search social media, old emails, or forwarded screenshots.
Do not bury this information in a blog post. A visitor looking for reassurance needs to see it without navigating through multiple pages.
Keep the wording provisional when facts are incomplete
A suspected incident is not the time to fill gaps with assumptions. If the cause, scope, or affected systems are unknown, say so plainly.
Examples of careful language:
- “We are aware that some customers may have received unusual messages.”
- “We are reviewing the situation and will share verified information on this page.”
- “Please use the contact details published on our website if you need help.”
- “We will update this notice when we can confirm additional information.”
This protects customers from confusion and prevents the business from having to correct overly certain claims later.
Give customers a safe way to verify messages
When customers receive suspicious messages, they may not know which emails, texts, social posts, or direct messages are genuine. Your website should become the reference point.
Create a small “How to verify a message from us” section that covers only your real, established communication channels.
For example:
- List the official customer-service phone number already used by the business.
- Link to the official contact page.
- Link to the official social profiles, if applicable.
- Tell customers to visit the website directly rather than using a link in an unexpected message.
- Explain that customer support will not ask for information through channels the business does not use.
Be precise. Do not publish a broad promise such as “We will never ask for personal information” unless that is consistently true across your actual support and payment processes.
If customers need to contact you, make the path obvious. The contact page mistakes that cost local businesses leads guide can help you review whether your phone number, email address, hours, and response expectations are easy to find.
Route support questions without collecting more sensitive information
During a suspected security incident, a generic contact form may become a poor place for customers to submit screenshots, card numbers, passwords, account credentials, or other sensitive details.
Review your forms and support instructions right away.
Add a short privacy reminder to relevant forms
A temporary note can reduce the chance that a customer sends sensitive information through a basic website form:
Please do not send passwords, full payment-card details, account codes, or other sensitive information through this form. Use the contact options on this page for general support questions.
This is especially relevant for retailers with account logins, online checkout, loyalty programs, appointment bookings, or payment links.
For a broader review of what should and should not appear on a standard inquiry form, see Local business website lead form fields: what to ask and what to leave out.
Separate general inquiries from incident-related questions
If questions begin to increase, create a dedicated support path such as:
- A clearly labeled support email address
- A phone number during stated hours
- A contact-form dropdown option such as “Question about a suspicious message”
- A short update page with answers to the most common questions
This does not mean creating a complex incident-response system. It means giving customers a clear route so general sales questions, order questions, and suspicious-message reports do not all arrive as unstructured submissions.
If you add a new form field or option, make sure it works on mobile. Customers may be checking a message from their phone and looking for reassurance immediately.
Review payment, account, and order guidance
A retailer should not give detailed financial or security instructions beyond what qualified providers recommend. But the website can still help customers find the right official next step.
Review these areas for accuracy:
Payment pages
If checkout remains available, make sure payment and contact information on the page is current. If payment processing is affected, do not leave customers guessing.
A temporary message can state that payment questions should be directed to the retailer through its official support channel. If the issue may involve a payment provider, seek that provider’s guidance before publishing specific instructions.
Account-login pages
If customers use accounts to view orders, save addresses, or manage subscriptions, place the update notice near login access when relevant.
Avoid publishing unverified directions such as “reset your password immediately” unless that direction comes from the appropriate security or account-management process. If a verified password-reset process is needed, make sure the link is on your official domain and visible from the relevant account page.
Order tracking and delivery pages
Customers who receive a suspicious notification may wonder whether an order update is legitimate. Add a short reminder that official order-status information is available through the retailer’s normal website path.
Retailers that depend on shipping should also ensure their existing delivery information is clear. See Shipping delays and your local business website: what to update before customers ask for a practical approach to keeping order-related updates in one visible place.
Monitor lead forms and contact channels
A suspected incident may bring more customer questions. It may also create confusion among people who were already considering a purchase.
That does not mean a retailer will see a measurable increase in leads or support requests. It means the business should be prepared if inquiries rise.
For the first days after publishing a notice, check:
- New contact-form submissions
- General support email inboxes
- Website chat, if used
- Voicemail
- Social media direct messages
- Online order questions
- Appointment or consultation requests, if applicable
Look for patterns rather than treating every message as a separate issue. If several customers ask the same question, add a concise answer to the update page.
For example, if customers repeatedly ask whether a particular email is real, the website can say:
For the latest verified information, visit this page directly from your browser or use the phone number listed on our contact page.
Do not repost suspicious messages, screenshots, email addresses, or links unless qualified advisors have confirmed it is appropriate. Repeating potentially harmful content can spread confusion.
Create an update process before questions pile up
A website notice works best when someone owns it.
Choose one person who can collect approved updates and one person who can publish or request website changes. For a very small retailer, that may be the same owner or manager.
Use a simple internal process:
- Record the date and time of each website update.
- Keep a single approved version of the public message.
- Make sure customer-service staff use the same basic wording.
- Remove outdated notices once they are no longer useful.
- Preserve a record of what was published and when.
The goal is consistency. Customers should not see one answer on the homepage, a different answer in an email, and no information on the contact page.
If the website itself may be affected or you cannot verify that it is functioning as expected, contact qualified website-security support before relying on it as your only communication channel.
Use a short, careful website notice template
Use this as a starting point only. Replace bracketed text with facts you have verified, and have qualified security, legal, and payment-provider advisors review messaging when appropriate.
Customer update
We are aware that some customers may have received unusual messages appearing to relate to [Business Name].
We are reviewing the situation. At this time, we are sharing only verified information on this page.
If you have questions, please contact us using the phone number or contact form on our official website. Please do not send passwords, full payment-card details, or account codes through our contact form.
We will update this page when additional verified information is available.
Last updated: [Date and time]
This template intentionally does not claim that a breach occurred, identify a cause, or describe data impact. Those claims require evidence and appropriate professional guidance.
What not to publish
In an effort to be transparent, businesses can accidentally create more risk or confusion. Avoid publishing:
- Guesses about who caused the incident
- Claims that a specific system, account type, or customer record was affected without confirmation
- Detailed technical explanations that have not been verified
- Screenshots of suspicious messages that expose customer details
- Unverified safety instructions about passwords, payment cards, or account security
- Assurances that everything is safe when the review is still ongoing
- A promise of a future update date unless you know you can meet it
Also avoid treating the website notice as the security solution. Clear communication may help customers find reliable information, but it does not investigate, contain, or remediate a possible security issue.
For a preventive website-content review, read Local business website security: how to avoid exposing passwords in shared Google Docs and the local business website lead form privacy checklist.
A practical post-incident website follow-up
Once the immediate situation is resolved and you have appropriate guidance, revisit the pages customers used during the incident.
Check whether your website made it easy to find:
- A legitimate contact route
- Current store, order, and account information
- Official communications channels
- Support hours
- Answers to common customer questions
- A privacy reminder on forms
Then remove or archive the temporary notice so an old alert does not confuse future visitors. If a lasting customer-facing change is needed, replace the temporary banner with a clear, permanent policy or support-page update.
A suspected breach is stressful, but the public website can still do one useful job: give customers a stable place to find verified information without asking them to rely on an unexpected message.
StoopCraft builds done-for-you websites and provides on-page SEO for local businesses for $99/month. If your current website makes important updates difficult to publish or contact information hard to find, learn more about StoopCraft.
