On 6 October 2026, thousands of users of the ASOS mobile app received a push notification titled “Asos hacked”. The message claimed that the online fashion retailer’s data had been “fully compromised” and directed customers to a channel on the Telegram messaging service, according to The Guardian’s reporting of 6 October 2026<\/a>. The retailer said it was aware of the reports but did not confirm that any intrusion had taken place, and its website and app kept operating on the morning of the incident. Its shares fell more than 14 percent on the London Stock Exchange the same day.<\/p>\n
French customers are directly concerned: ASOS operates an official French-language storefront at asos.com\/fr<\/a>, and shoppers in France use the same accounts, the same mobile app and the same saved payment cards as customers elsewhere. When an alleged breach of this kind surfaces, the urgent question for a customer in France is a practical one: if money leaves your card through an order or a payment you never authorised, how do you get your bank to give it back, and what evidence should you keep from the first hour? That is the subject of this article. A companion analysis published the same day examines the general rights of customers in France after a breach notification in broader terms (Has ASOS Been Hacked? Snowflake Breach Claim, Hack Notification and Rights of Customers in France<\/a>); the present article focuses on one narrower and more urgent scenario, namely unauthorised payments charged to a card saved on an online account, and the refund procedure before a French bank.<\/p>\n Two reserves apply throughout. At the time of writing, no intrusion has been confirmed by any official source: the incident rests on a notification whose origin is disputed and on an investigation the company says is ongoing. Nothing in this article establishes any liability on the part of any company. The guidance below is general: it describes the checks and remedies available to any customer in France facing an unauthorised payment after an alleged breach, and only a judge decides individual cases.<\/p>\n What is established comes from press reports describing the same observable facts. According to The Guardian, customers received a push message titled “Asos hacked” with a link sending them to Telegram, and the message was presented as addressed to the company’s data protection officer and IT team, claiming that the retailer’s Snowflake data platform had been fully compromised. Snowflake is a cloud platform used to store, process and analyse data including transactions and demographic information such as clothing sizes and body measurements, and it also enables push notifications to customers’ phones. The BBC also covered the incident on 6 October 2026, reporting app users’ accounts of a “concerning” pop-up message apparently sent by hackers.<\/p>\n What is not established matters just as much. The company said it was aware of the reports of a hack but did not confirm that one had occurred, and it is understood to be still investigating whether any intrusion took place. The Telegram channel was presented as operated by an apparent cyber gang calling itself the Xuanye group, a name cybersecurity experts said they had not encountered before on hacker forums or other Telegram channels. One threat researcher quoted in the press noted that new groups sometimes wait for a significant opportunity before announcing themselves in order to enter the ecosystem with credibility. In other words, the notification could reflect a genuine compromise of a data platform, an intrusion limited to the push-notification system, or an attention-seeking claim with no access behind it. No official source had confirmed any of these hypotheses at the time of writing, and the website and app appeared to keep functioning normally.<\/p>\n For a customer in France, the right attitude is therefore neither panic nor dismissal. The notification is a warning signal that justifies immediate precautionary steps, particularly where a payment card is saved on the account. It is not proof that your data was accessed, and even less proof that a payment you see on your statement is linked to this incident. Each hypothesis must be tested against your own evidence: orders you recognise, login alerts you received, and statements from your bank. The sections below explain how French law allocates the burden of proof once you dispute a payment, which is precisely why preserving evidence from the first hour counts.<\/p>\n The broader context reinforces caution without changing this analysis. The alleged incident follows a string of cyber incidents affecting British retailers last year, including Marks and Spencer, the Co-op and Harrods, with stock shortages and a website closure of several weeks in one case. Cybersecurity professionals quoted in the press also warned of the classic second wave: criminals exploiting the publicity by sending emails and text messages claiming to come from the retailer, asking customers to reset a password, confirm payment details, check an order or claim a refund. That warning is worth taking literally, because the most immediate danger after a publicised claim is often not the alleged breach itself but the phishing campaign that rides on it.<\/p>\n The first reflex is to separate the account from the money. Open the retailer’s app or website by typing its address yourself or through your usual bookmark, never through a link received by text message, email or push notification in the days following the incident. Change the account password to a long password used nowhere else, and activate two-factor authentication where the platform offers it. Then review the account: recent orders, delivery addresses you do not recognise, changes to the email address or phone number attached to the account, and saved payment instruments. If an order you did not place appears, take screenshots showing the order number, the date, the amount, the delivery address and the payment method used. If nothing appears, keep a dated record of that verification too, because a clean history on the day of the alert is also evidence.<\/p>\n The second reflex concerns the payment card itself. French law requires the payment service user who learns of the loss, theft, misappropriation or any unauthorised use of a payment instrument or of the data linked to it to inform the provider without delay so that the instrument can be blocked. Article L133-17 of the Code mon\u00e9taire et financier states: “Lorsqu’il a connaissance de la perte, du vol, du d\u00e9tournement ou de toute utilisation non autoris\u00e9e de son instrument de paiement ou des donn\u00e9es qui lui sont li\u00e9es, l’utilisateur de services de paiement en informe sans tarder, aux fins de blocage de l’instrument, son prestataire ou l’entit\u00e9 d\u00e9sign\u00e9e par celui-ci.” (Where the payment service user has knowledge of the loss, theft, misappropriation or any unauthorised use of his payment instrument or of the data relating to it, he shall inform his provider, or the entity designated by the latter, without delay, for the purpose of blocking the instrument.) The full text is available on L\u00e9gifrance, article L133-17<\/a>. In practice, call your bank’s card-blocking (opposition) number immediately, note the date, time and reference number of the call, and confirm the opposition in writing. Blocking does not replace disputing the payment: it stops future use of the card data, while the refund procedure described in Part II addresses the amounts already taken.<\/p>\n The third reflex is to distrust every message that follows the incident. The French data protection authority, the CNIL, warns that phishing messages after a leak look realistic precisely because they reuse data obtained through the leak, for example a supposed email from social security, from your bank or from parcel delivery services, and it advises in its guidance for victims of data leaks or theft<\/a>. Do not open attachments, do not enter card details on a page reached from a message, and do not call a phone number given in a suspicious text: call the number on the back of your card or in your banking app instead. The CNIL also states that where a breach exposes you to potential risks, the organisation responsible must inform you without delay: \u201cSi une violation vous concerne et qu’elle vous expose potentiellement \u00e0 des risques, l’organisme responsable doit vous en informer dans les meilleurs d\u00e9lais.\u201d (If a breach concerns you and potentially exposes you to risks, the organisation responsible must inform you without delay.) You can therefore write to the retailer’s data protection officer, ask whether your data is affected, and keep a copy of your request and of any answer. Conversely, the CNIL advises against using third-party websites that claim to hold leaked data and offer to tell you whether you are affected: “La CNIL d\u00e9conseille de les utiliser.” (The CNIL advises against using them.)<\/p>\n The fourth reflex is to build the file a bank, an authority or a court would need. Keep the notification itself with its date and time, your screenshots of the account and of any unknown order, your bank statements showing the disputed debit, the reference of your opposition call and its written confirmation, your written dispute sent to the bank, and your correspondence with the retailer’s data protection officer. French law sets a thirteen-month deadline from the debit date to report an unauthorised transaction, on pain of foreclosure, as explained in Part II; starting the file on day one is what makes that deadline harmless rather than dangerous. If several members of the same household hold accounts on the same platform, each person keeps their own file, because refund and compensation rights are individual.<\/p>\n French law starts from a simple principle: a payment you did not authorise is for your bank to bear, not for you, once you have reported it. After blocking the card, dispute the transaction with your bank in writing, identifying the debit by date and amount, stating that you did not authorise it, and attaching your opposition reference and supporting screenshots. Send this dispute by a traceable means and keep proof of sending, because the refund clock runs from the moment the bank learns of the transaction or is informed of it. Article L133-18 of the Code mon\u00e9taire et financier provides: “le prestataire de services de paiement du payeur rembourse au payeur le montant de l’op\u00e9ration non autoris\u00e9e imm\u00e9diatement apr\u00e8s avoir pris connaissance de l’op\u00e9ration ou apr\u00e8s en avoir \u00e9t\u00e9 inform\u00e9, et en tout \u00e9tat de cause au plus tard \u00e0 la fin du premier jour ouvrable suivant, sauf s’il a de bonnes raisons de soup\u00e7onner une fraude de l’utilisateur du service de paiement et s’il communique ces raisons par \u00e9crit \u00e0 la Banque de France.” (the payer’s payment service provider shall refund to the payer the amount of the unauthorised transaction immediately after becoming aware of the transaction or after having been informed of it, and in any event no later than the end of the first business day following, unless it has good reasons to suspect fraud by the payment service user and it communicates those reasons in writing to the Banque de France.) The same article adds that the provider must restore the debited account to the state it would have been in had the transaction not taken place, and that late refunds bear interest at the legal rate increased by five points, then ten points beyond seven days of delay and fifteen points beyond thirty days. The full text is available on L\u00e9gifrance, article L133-18<\/a>. Concretely, a bank that receives your written dispute on a Tuesday must normally have restored the funds by the end of Wednesday, and any refusal based on suspected fraud on your part must be reasoned in writing to the Banque de France, not simply asserted to you.<\/p>\n Two limits frame this right, and both are narrower than customers often fear. The first is the fifty-euro cap, which applies only where the unauthorised transaction follows the loss or theft of the payment instrument, and even then with broad exceptions. Article L133-19 states that, before the notification provided for in Article L. 133-17, the payer bears “les pertes li\u00e9es \u00e0 l’utilisation de cet instrument, dans la limite d’un plafond de 50 \u20ac” (the payer shall bear, before the notification provided for in Article L. 133-17, the losses relating to the use of that instrument, up to a ceiling of 50 euros.) But the same article removes the payer’s liability entirely for transactions carried out without using personalised security data: “la responsabilit\u00e9 du payeur n’est pas engag\u00e9e en cas : \u2013 d’op\u00e9ration de paiement non autoris\u00e9e effectu\u00e9e sans utilisation des donn\u00e9es de s\u00e9curit\u00e9 personnalis\u00e9es” (the payer’s liability is not engaged in the case of: \u2013 an unauthorised payment transaction carried out without using personalised security data). The full text is available on L\u00e9gifrance, article L133-19<\/a>. Where only card data saved on a merchant account was reused, with no loss or theft of the physical card and no strong authentication by you, the fifty-euro franchise has no room to apply, and the refund must be total. Check your bank’s response on this exact point: a letter invoking the fifty-euro cap for a card-not-present payment authenticated without your security credentials misstates the article.<\/p>\n The second limit is time. Article L133-24 requires the user to report an unauthorised or incorrectly executed transaction without delay and no later than thirteen months after the debit date, on pain of foreclosure: “L’utilisateur de services de paiement signale, sans tarder, \u00e0 son prestataire de services de paiement une op\u00e9ration de paiement non autoris\u00e9e ou mal ex\u00e9cut\u00e9e et au plus tard dans les treize mois suivant la date de d\u00e9bit sous peine de forclusion” (The payment service user shall report to his payment service provider, without delay, any unauthorised or incorrectly executed payment transaction and no later than thirteen months following the debit date, on pain of foreclosure). The full text is available on L\u00e9gifrance, article L133-24<\/a>. Thirteen months is generous, but the sanction is radical: after the deadline, the dispute is inadmissible even if the fraud is proven. Report within days, not months, and diarise the deadline separately for each disputed debit, because each transaction carries its own thirteen-month clock.<\/p>\n The decisive advantage for the customer lies in the burden of proof. When you deny having authorised an executed payment, it is for the bank to prove that the transaction was authenticated, duly recorded and accounted for, and unaffected by any technical or other deficiency. Article L133-23 provides: “il incombe \u00e0 son prestataire de services de paiement de prouver que l’op\u00e9ration en question a \u00e9t\u00e9 authentifi\u00e9e, d\u00fbment enregistr\u00e9e et comptabilis\u00e9e et qu’elle n’a pas \u00e9t\u00e9 affect\u00e9e par une d\u00e9ficience technique ou autre.” (it shall be for his payment service provider to prove that the transaction in question was authenticated, duly recorded and accounted for and that it was not affected by any technical or other deficiency.) The article adds that the recorded use of the payment instrument as logged by the provider is not necessarily sufficient in itself to prove authorisation: “L’utilisation de l’instrument de paiement telle qu’enregistr\u00e9e par le prestataire de services de paiement ne suffit pas n\u00e9cessairement en tant que telle \u00e0 prouver que l’op\u00e9ration a \u00e9t\u00e9 autoris\u00e9e par le payeur” (The use of the payment instrument as recorded by the payment service provider shall not necessarily in itself suffice to prove that the transaction was authorised by the payer). The full text is available on L\u00e9gifrance, article L133-23<\/a>. A bank therefore cannot defeat your dispute merely by producing its logs showing that the correct card number, expiry date and cryptogram were used: it must establish that you authenticated the payment, which, for a fraudulent order placed from your saved card data by a third party, it will struggle to do. If the bank maintains its refusal, ask for its written reasoning, escalate to its complaints department and then to the banking mediator named in your account agreement, and consider legal advice, since only a court can finally allocate liability where the parties disagree.<\/p>\n Recovering the money does not exhaust the matter, because three distinct tracks can follow: criminal, regulatory and civil. On the criminal track, fraudulently accessing or remaining within all or part of an automated data processing system is punishable by three years’ imprisonment and a 100,000 euro fine. Article 323-1 of the Code p\u00e9nal states: “Le fait d’acc\u00e9der ou de se maintenir, frauduleusement, dans tout ou partie d’un syst\u00e8me de traitement automatis\u00e9 de donn\u00e9es est puni de trois ans d’emprisonnement et de 100 000 \u20ac d’amende.” (Unlawfully accessing or remaining within all or part of an automated data processing system shall be punishable by three years’ imprisonment and a fine of 100,000 euros.) The full text is available on L\u00e9gifrance, article 323-1 of the Code p\u00e9nal<\/a>. A customer who suffered fraudulent orders can file a criminal complaint, in person at a police station or gendarmerie or by online pre-complaint, attaching the file assembled in the first hours: notification, screenshots, statements, opposition reference and bank correspondence. Two neighbouring criminal provisions complete the picture. Fraudulently collecting personal data by deceitful, unfair or unlawful means carries five years\u2019 imprisonment and a 300,000 euro fine. Article 226-18 of the Code p\u00e9nal states: “Le fait de collecter des donn\u00e9es \u00e0 caract\u00e8re personnel par un moyen frauduleux, d\u00e9loyal ou illicite est puni de cinq ans d\u2019emprisonnement et de 300 000 euros d\u2019amende.” (Collecting personal data by fraudulent, unfair or unlawful means shall be punishable by five years\u2019 imprisonment and a fine of 300,000 euros.) The full text is available on L\u00e9gifrance, article 226-18 of the Code p\u00e9nal<\/a>. Likewise, fraudulently extracting, holding, reproducing, transmitting, deleting or altering data in an automated processing system carries five years\u2019 imprisonment and a 150,000 euro fine: “Le fait d\u2019introduire frauduleusement des donn\u00e9es dans un syst\u00e8me de traitement automatis\u00e9, d\u2019extraire, de d\u00e9tenir, de reproduire, de transmettre, de supprimer ou de modifier frauduleusement les donn\u00e9es qu\u2019il contient est puni de cinq ans d\u2019emprisonnement et de 150 000 \u20ac d\u2019amende.” (Fraudulently introducing data into an automated processing system, or fraudulently extracting, holding, reproducing, transmitting, deleting or altering the data it contains, shall be punishable by five years\u2019 imprisonment and a fine of 150,000 euros.) The full text is available on L\u00e9gifrance, article 323-3 of the Code p\u00e9nal<\/a>. The complaint does not guarantee identification of the perpetrators, particularly where the trail leads abroad, but it creates an official record, supports any later civil claim, and allows investigators to link cases arising from the same incident. Keep the complaint receipt with the rest of the file.<\/p>\n On the regulatory track, the General Data Protection Regulation organises the duties that follow a personal data breach. The controller must notify the competent supervisory authority, in France the CNIL, without undue delay and where feasible within seventy-two hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Article 33(1) of Regulation (EU) 2016\/679 provides: \u201cEn cas de violation de donn\u00e9es \u00e0 caract\u00e8re personnel, le responsable du traitement en notifie la violation en question \u00e0 l’autorit\u00e9 de contr\u00f4le comp\u00e9tente conform\u00e9ment \u00e0 l’article 55, dans les meilleurs d\u00e9lais et, si possible, 72 heures au plus tard apr\u00e8s en avoir pris connaissance, \u00e0 moins que la violation en question ne soit pas susceptible d’engendrer un risque pour les droits et libert\u00e9s des personnes physiques.\u201d (In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.) Where the breach is likely to result in a high risk to your rights and freedoms, the controller must also communicate it to you without undue delay: \u201cLorsqu’une violation de donn\u00e9es \u00e0 caract\u00e8re personnel est susceptible d’engendrer un risque \u00e9lev\u00e9 pour les droits et libert\u00e9s d’une personne physique, le responsable du traitement communique la violation de donn\u00e9es \u00e0 caract\u00e8re personnel \u00e0 la personne concern\u00e9e dans les meilleurs d\u00e9lais.\u201d (Where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.) Both provisions are in the the French text of Regulation (EU) 2016\/679 on the protection of natural persons with regard to the processing of personal data (GDPR). If the company’s answer to your data protection officer request is missing, late or evasive, you can complain to the CNIL through its online complaints service, after first contacting the organisation, following the steps described in the CNIL’s victim guidance<\/a>. A CNIL complaint seeks regulatory action, not money: it can lead to investigation and sanction, but it does not itself award you damages.<\/p>\nI. The “Asos hacked” notification: what it shows and what to do in the first hours<\/h2>\n
A. Has ASOS been hacked? Reading the notification of 6 October 2026 with caution<\/h3>\n
B. First hours: secure the account, block the card and preserve the evidence<\/h3>\n
II. Unauthorised payment on your card: how French law gets your money back<\/h2>\n
A. Opposition, immediate refund, 50 euros cap and 13-month deadline: the bank’s obligations<\/h3>\n
B. After the refund: criminal complaint, CNIL complaint and GDPR compensation<\/h3>\n