ASOS data breach: customer accounts opened with login details taken outside ASOS, July 2026

What happened at ASOS?

The letter does not describe a break-in to ASOS's own systems. It describes access to individual customer accounts with working usernames and passwords that came from somewhere else. ASOS spotted unusual activity on the accounts on Tuesday, July 28, 2026 and began an investigation. On July 29 it confirmed that an outside party may have logged in with those credentials. The letter does not say where the credentials came from, how many login attempts there were, or how many accounts were actually opened.

The letter is written on behalf of ASOS US Sales LLC, based at 97 N 10th Street in Brooklyn, and its affiliate ASOS.com Limited. California's record gives July 28, 2026 as the date of the breach, the same day ASOS says it saw the activity.

Date	What happened	Source
July 28, 2026	ASOS detects unusual activity on customer accounts	Notice letter, California AG record
July 29, 2026	ASOS confirms outside access with credentials from elsewhere; blocks the accounts and forces a password reset	Notice letter
July 30, 2026	ASOS emails customers that they must reset their passwords	Notice letter
August 21, 2026	Letter date; notice sent, per Indiana; published by Texas; reported to Washington	Notice letter, Indiana, Texas and Washington records

What did ASOS do about it?

ASOS's security operations team blocked access to the affected accounts on July 29 and made a password reset mandatory. The company emailed customers on Thursday, July 30 to tell them they had to reset their passwords, about three weeks before the letter.

For a small number of accounts, ASOS saw suspicious transactions. Those were either blocked automatically or cancelled by its fraud staff, and it says it has seen no further unauthorized activity since. The letter gives no number for those accounts.

What information was in the ASOS accounts?

The letter lists what an ASOS account holds and so what an intruder could have seen:

• name, email address, delivery or billing address and telephone number;
• redacted payment card details: the cardholder name, the last four digits of the card and its expiration date;
• details of social media accounts linked to the ASOS account, but not their login credentials;
• date of birth.

No full card numbers, Social Security numbers or passwords to other services are on the list. The state records describe the same data in their own categories. Texas marks name, address, financial information, date of birth and "other". Washington lists name, financial and banking information, full date of birth, and email address and password or security question answers. That last category fits the way in that the letter describes: the outsider already had the login details.

How many people were affected by the ASOS breach?

Indiana's record is the only one with a total: 138,828 people. That places ASOS among the larger 2026 notices on Indiana's list, as the ranking of 2026 breaches by people affected shows. Three states count their own residents:

Record	People counted
Indiana attorney general, total	138,828
Texas residents	9,412
Washington residents	1,929
Indiana residents	1,386

Texas published its report on August 21, 2026. Washington shows a report date of August 21, 2026 and a breach date of July 28, 2026. The ranking of breaches affecting Texans and the Washington ranking compare these counts with other 2026 notices.

Was my ASOS account in the data breach?

If ASOS emailed you on or around July 30, 2026 to say you had to reset your password, or a letter dated August 21, 2026 reached you, ASOS found activity on your account. The letter asks customers to watch their payment account activity and statements. Questions go through ASOS's US customer care page at asos.com/us/customer-care/get-in-touch, or by post to the Brooklyn address. The letter gives no dedicated phone line.

Because the login details came from outside ASOS, the same email and password may work on other sites where you used them. The letter does not give that advice itself. It points to free credit reports, fraud alerts and credit freezes through Equifax, Experian and TransUnion, and to the Federal Trade Commission at identitytheft.gov. The guide to credit-monitoring offers sets letters that offer a service against those, like this one, that do not.

Did ASOS delay the notice?

Not at the request of the police. The California section of the letter says the notice was not delayed by law enforcement. The letter went out 24 days after the activity was detected. The guide to how long organizations take to notify measures those gaps. The guide to payment card breach notices covers retailers whose checkout pages, not their customers' accounts, were the target.

What the notice leaves open

• Where the login credentials came from, and whether they were from an earlier breach at another company.
• How many accounts were actually opened, against the 138,828 people Indiana counts.
• How many accounts showed suspicious transactions, and their value.
• Whether customers outside the United States were affected; the letter covers ASOS US Sales LLC and ASOS.com Limited.