ASOS US Sales LLC, the US sales entity of online fashion retailer ASOS, has notified US customers that an unauthorized third party may have accessed their accounts using login credentials obtained outside the company. ASOS detected the activity on July 28, 2026 and sent formal breach notices dated August 21. The company has not published the number of people affected.
According to the notice filed with the California Attorney General, ASOS detected unusual activity involving customer accounts on July 28, 2026 and began an investigation. On July 29 it confirmed that an unauthorized third party may have gained access using "login credentials obtained from a source outside ASOS." The notice is sent on behalf of ASOS US Sales LLC and its affiliate ASOS.com Limited.
The same day, the company's security operations team blocked access to the affected accounts and imposed a mandatory password reset. ASOS emailed those customers on July 30 to tell them they would need to reset their passwords. The formal notice letters are dated August 21, 23 days after the access was confirmed. The California notice states that it was not delayed by law enforcement.
ASOS has not said where the credentials came from, and its notice does not describe a compromise of its own systems. Trade press, including eSecurity Planet, has described the incident as consistent with credential stuffing, in which passwords exposed at one service are tried against another. That is a press characterization; ASOS does not use the term. The incident date used for this report is the detection date. When the activity began has not been disclosed.
The notice frames all of the following as information that may have been accessed, not as confirmed losses: name, email address, delivery or billing address, telephone number, date of birth, details of associated social media accounts (but not their login credentials), and redacted payment card details, meaning cardholder name, the last four digits of the card and its expiration date. The notice does not list full card numbers or security codes.
ASOS says it saw evidence of suspicious transactions on a small number of accounts. Those transactions were either blocked automatically or canceled manually by its fraud staff, and the company says it has seen no further unauthorized activity since.
ASOS has not published a population figure. CyberInsider reported that a law firm's investigation notice puts the number at 138,828 individuals. That figure does not come from ASOS and should be treated as unconfirmed. The notice addresses US customers; whether accounts outside the United States were affected has not been stated.
Nothing in the disclosure points to a flaw in the retailer's own systems. The attacker arrived with passwords that worked. ASOS spotted the activity, confirmed it within a day and forced resets the same day, which is a fast response by most measures. The consequences still landed on the retailer: fraud handling, formal notification to customers and state regulators, and, within days, law firm investigation notices. Password reuse is a customer habit, but the account takeover it produces is the retailer's incident.
For any business that runs customer accounts with saved addresses and payment details, the question to ask this week is: if valid customer passwords were tried against our login at volume tonight, what would flag it, and what would a successful login reveal? Controls worth testing include anomaly and rate detection on login, screening passwords against known breached lists, a second verification step before saved payment details are shown or a delivery address is changed, and trimming what a logged-in profile displays, such as dates of birth and linked social accounts. Decide in advance when a forced password reset becomes a formal notification, because here those two events were more than three weeks apart. This is identity, access and fraud work, and continuous monitoring of login behavior is what keeps detection measured in hours.
How many people were affected, where the credentials came from, how long the activity ran before July 28, whether accounts outside the United States were involved, whether additional login protections were available to the affected customers, and whether any regulator will take action.
1. Notice of data breach from ASOS US Sales LLC, ASOS US Sales LLC, filed with the California Attorney General, August 21, 2026. Confirms the July 28 detection, July 29 confirmation and password reset, July 30 customer email, how access was gained, the data types that may have been accessed, the suspicious transactions and that the notice was not delayed by law enforcement.
2. ASOS credential-stuffing attack exposed data of 138,828 customers, CyberInsider, August 24, 2026. Reports the 138,828 figure and attributes it to a law firm investigation notice published August 21, not to ASOS.
3. ASOS Account Takeover Attack Exposes Data of 138,828 Customers, eSecurity Planet, August 26, 2026. Corroborates the notice and characterizes the incident as consistent with credential stuffing or account takeover.
