Asos (ASC LN) confirms no payment information was accessed in the security breach

Clarifications of this kind follow a familiar sequence in corporate breach episodes: an initial disclosure of a security incident, a period of uncertainty over its scope, and then a narrowing statement on what was and was not compromised. The distinction that has historically mattered is payment data versus personal data, since card details accessed tends to bring direct remediation costs, card scheme exposure and regulatory scrutiny of a different order than names and contact details, and share price reactions in past retail-sector breaches have tracked that line closely. Confirmation that payment information was untouched typically caps the worst-case scenario, leaving the residual questions around customer data volume, regulatory notification obligations in the UK and EU, and any operational disruption to fulfilment. The SNOW.US tag suggests a third-party or cloud vendor linkage, and in comparable incidents the follow-on has been whether the vendor or the listed company bears disclosure responsibility and how many other clients of the same vendor surface in subsequent days. Worth noting is the company's prior form on disclosure speed and whether regulators open a formal process, as those have tended to determine how long the story runs rather than the headline itself.