Asos (ASC LN), on reports of a cyber incident, says they do not believe payment-card information or passwords were impacted

Company disclosures of this kind follow a familiar sequence: an initial statement scoping the incident, followed by regulatory notification obligations and, in the UK, any engagement with the Information Commissioner's Office where personal data is involved. The distinction that has historically mattered for equity reaction is whether payment data or credentials were compromised, since that determines exposure to card-scheme fines, regulatory penalties and customer remediation costs; denial of that exposure at the outset has tended to cap the event as an operational rather than financial story, though early assurances have on occasion been revised as forensic work progresses. For an online-only retailer the operational channel is the more immediate one: past incidents at comparable e-commerce names have shown the revenue hit comes from site downtime or fulfilment disruption rather than the breach itself, so duration of any outage is the metric that separates a headline from a numbers story. Worth noting is whether the statement addresses trading continuity, and whether a ransomware actor or third-party supplier is subsequently identified, both of which have been the pattern in retail-sector episodes of this kind. Follow-ons are any regulatory filing, confirmation of systems restoration, and disclosure of estimated cost in the next scheduled update.