ASOS US Sales LLC Reports Data Breach Affecting Nearly 10,000 Consumers ASOS US Sales LLC, the U.S. arm of the global online fashion retailer, has disclosed a data breach exposing sensitive personal and financial information of nearly 10,000 customers. The breach was reported to the attorneys general of Texas and Vermont on August 21, 2026, with 9,412 Texas residents and 80 Vermont residents confirmed as affected. Details surrounding the incident including when the breach occurred, how it was discovered, and the specific nature of the attack remain undisclosed. However, the exposed data includes full names, addresses, dates of birth, financial information (such as account and credit/debit card numbers), and other unspecified sensitive details. According to filings with the Texas Attorney General, ASOS has not yet notified affected individuals about the breach. Consumers who have placed orders through the ASOS U.S. platform are advised to watch for official communications from the company and monitor their accounts for suspicious activity. The full scope of the breach’s impact is still under review.

ASOS Notifies U.S. Customers of Credential Stuffing Attack ASOS US Sales LLC began notifying affected customers on July 30, 2026, after detecting unauthorized access to accounts linked to credentials obtained from external sources. The incident was identified on July 28, when unusual activity was observed in certain ASOS accounts. An investigation the following day confirmed that a third party had accessed these accounts using login details from unrelated breaches, phishing campaigns, or password reuse rather than exploiting a vulnerability in ASOS’s systems. The exposed data may have included customer names, email addresses, delivery and billing details, phone numbers, dates of birth, and linked social media account information. While full payment card numbers and CVV values were not compromised, redacted card details such as the cardholder’s name, last four digits, and expiration date were potentially accessed. Though this limited payment data is insufficient for direct fraud, it could be used in phishing or social engineering attacks to extract further sensitive information. ASOS’s security team responded swiftly, blocking access to affected accounts and enforcing mandatory password resets on July 29. Suspicious transactions were either automatically blocked or manually canceled by the fraud team, and no further unauthorized activity was detected after these measures. Despite the rapid containment, the public notification was issued on August 21, over three weeks after the initial detection. The incident underscores the persistent threat of credential stuffing attacks, where attackers leverage stolen credentials from other breaches to gain unauthorized access. ASOS confirmed that no internal systems were compromised, attributing the breach solely to the misuse of valid account credentials.