Online fashion retailer ASOS has confirmed that attackers logged into customer accounts using credentials sourced from outside its systems, exposing personal details and redacted payment card data belonging to US customers. The company detected unusual account activity on July 28, 2026, confirmed unauthorized third-party access the following day, and began notifying affected individuals in letters dated August 21, 2026, alongside filings with the California Attorney General and, per the Texas filing, at least a dozen other state regulators. Victim counts vary sharply by source: the Texas Attorney General filing lists 9,412 Texas residents (via ClaimDepot), while Srourian Law Firm's investigation notice puts the total at approximately 138,828 individuals (via CyberInsider). ASOS itself has not published a headline figure.
What Happened
According to ASOS US Sales LLC's own breach notification, the retailer identified unusual activity involving customer accounts on July 28, 2026 and opened an investigation immediately. By July 29 it had determined that an unauthorized third party may have accessed those accounts using login credentials obtained from a source outside ASOS. Access to the affected accounts was blocked the same day, July 29.
The critical detail ASOS emphasises is provenance: the credentials did not come from a compromise of ASOS systems or its credential store. That framing points to classic account takeover, where username and password pairs harvested elsewhere are replayed against an unrelated service. ASOS has not disclosed how the attackers obtained the credentials, nor whether they trace back to earlier third-party breaches, phishing, infostealer malware, or combolists circulating on criminal markets.
BreachNews reports that suspicious transactions were detected on a small number of affected accounts, indicating the intrusion was not purely reconnaissance. The gap between detection on July 28 and customer notification on August 21 is roughly three and a half weeks.
Accounts differ on the disclosure itself. ClaimDepot, summarising the Texas Attorney General filing dated August 21, states that at the time of filing the company had not provided notice to affected individuals and that the nature and timing of the incident remained undisclosed. CyberInsider and BreachNews, working from the notification letters themselves, describe letters dated August 21 with a full incident timeline. The most likely explanation is filing lag rather than genuine contradiction, but the discrepancy is worth noting rather than smoothing over.
What Was Taken
ASOS states the exposed data varies account by account. Per the notification text reproduced by both CyberInsider and BreachNews, potentially accessed information includes:
- Full names
- Email addresses
- Delivery and billing addresses
- Telephone numbers
- Dates of birth
- Details of linked social media accounts, explicitly excluding social media login credentials
- Limited payment card information: cardholder name, last four digits of the card number, and expiration date
ASOS is clear that payment data was redacted. The notification does not indicate that full card numbers, CVV security codes, or ASOS account passwords were exposed.
That description conflicts with ClaimDepot's summary, which lists financial information "including account numbers and credit or debit card numbers" and displays a broader category grid covering Social Security numbers, government IDs, and medical information. ClaimDepot is a lower-tier source and its category grid appears to be a generic template rather than a specific finding; its own page notes the affected information types were "not yet disclosed." Weighting the company's own notification over the aggregator, defenders should treat the redacted-card description as the accurate one until a regulator filing says otherwise.
On volume, the honest answer is that no confirmed total exists. The 138,828 figure originates from a plaintiffs' law firm investigation notice, not from ASOS or a regulator. The 9,412 figure is a Texas-only subset drawn from a state filing. The two are not mutually exclusive, and neither has been corroborated by ASOS.
Why It Matters
This incident is not novel, and that is precisely the point. Palo Alto Networks Unit 42, in its threat brief on large-scale credential attacks updated August 18, 2026, frames the shift bluntly: identity has become the perimeter, and cybercriminals are increasingly choosing to log in rather than break in. Unit 42 documents the pattern of attackers gathering previously leaked credential pairs and then pivoting to password spraying against any internet-exposed service, citing the TheHatman campaign against Microsoft Entra tenants in August 2026 and the FortiBleed password-spraying wave against Fortinet devices in June 2026.
Consumer retail sits at the soft end of that same spectrum. BleepingComputer reported in July that Chick-fil-A notified customers after unauthorized parties ran an automated attack against its website and mobile app between June 17 and 19, 2026, using email and password pairs obtained from a third-party source, with 2,182 Texans affected. The exposed data set was near-identical to ASOS's: names, emails, phone numbers, addresses, dates of birth, and last four card digits. Two large consumer brands, two months apart, same technique, same outcome.
The strategic significance for defenders is that no ASOS system was breached and ASOS still has a reportable incident, multi-state regulatory filings, and a law firm investigation notice attached to its name. Password reuse by customers transfers risk onto the platform regardless of how well the platform secures its own credential store. Notably, ASOS is not an unstaffed target: public professional profiles show a Head of Security Operations with CISSP, CISM, GCIH and GCIA credentials, and a Cyber Security Product Manager reporting to the CISO whose stated focus areas include CDN, WAF, bot and agent management, consumer identity, and fraud and payments under PCI. A mature edge and identity program did not prevent the takeovers, though the one-day detection-to-containment window suggests those controls worked once activity started.
The Attack Technique
The mechanics map to MITRE ATT&CK T1110.004 (Credential Stuffing), a sub-technique of brute force. Attackers acquire validated or unvalidated credential pairs from prior breaches, infostealer logs, or bulk combolists, then automate authentication attempts against a target's web login and mobile API endpoints. Success rates are low per attempt but the economics work at volume, and every hit yields an account with stored addresses, order history, saved payment tokens, and loyalty balances.
ASOS has not stated whether the attempts hit its website, its mobile app, or its APIs, nor has it published attempt volumes, source infrastructure, or indicators of compromise. No threat actor has claimed the ASOS intrusion. Attribution should be treated as open.
For context on the wider identity-attack landscape, CyberInsider separately reported that ReliaQuest contained a social engineering attack on August 22, 2026 in which a lookalike domain, a cloned SSO page, and an MFA push approval briefly gave an attacker a valid identity session, later claimed by ShinyHunters on its leak site. There is no reported connection between that incident and ASOS, and the technique differs entirely. It is included here only as evidence of how broadly identity is being targeted as the primary entry vector across sectors.
Unit 42's detection guidance for this class of attack is to audit remote access and authentication logs with a focus on successful logins occurring shortly after high-volume authentication failure events, the signature pattern of a spraying or stuffing run finding a valid pair.
What Organizations Should Do
Hunt for the success-after-failure signature. Following Unit 42's guidance, query authentication logs for successful logins that immediately follow bursts of failed attempts from the same source ASN, IP range, or device fingerprint. This is the highest-value single detection for credential stuffing and it works retroactively across historical logs.
Make MFA the default on consumer accounts, not an opt-in. Credential stuffing fails against accounts with a second factor. Consumer retail has historically avoided mandatory MFA on conversion-rate grounds; step-up authentication triggered by risk signals such as new device, new geography, or a change to shipping address is the compromise that preserves both.
Screen credentials against known-breached corpora at registration and login. Rejecting or force-rotating passwords that appear in public breach datasets removes the exact population of accounts these campaigns are built to find. ASOS already advises customers to use a unique password, but advice is not a control.
Deploy bot management on login and account-management endpoints specifically. Rate limiting alone is defeated by distributed proxy infrastructure. Behavioural and device-integrity checks at the authentication layer, covering mobile API paths as well as web, are what actually raise attacker cost. Note that Chick-fil-A's attackers hit both website and mobile app.
Tokenise and minimise stored payment data. ASOS's exposure was limited to cardholder name, last four digits, and expiry precisely because it does not retain full PANs or CVVs in customer profiles. That decision is the difference between a notification letter and a PCI incident. Audit what your account profiles actually render back to a logged-in session.
Instrument post-authentication behaviour, not just the login event. The suspicious transactions ASOS detected show that takeover is followed by action. Alert on anomalous sequences inside authenticated sessions: bulk address changes, new payment method additions, gift card redemptions, or rapid checkout from a newly seen device.
Pre-build the multi-state notification workflow. ASOS filed with California, Texas, and by the Texas filing's own source list at least ten other state regulators. Aggregators and plaintiffs' firms will publish figures from those filings before your own numbers are final, and inconsistent counts across states become the story.
Sources: ASOS Data Breach Exposes Customer Account Information | Threat Brief: Mitigating Large-Scale Credential Attacks (Updated Au... | Chick-fil-A discloses data breach after credential stuffing attacks | ASOS credential-stuffing attack exposed data of 138,828 customers | Asos US Data Breach Impacts 9k: Financial Information Compromised | ReliaQuest says claimed ShinyHunters attack was ... | Diana M. | Matthew Clements