ASOS US Sales LLC Data Breach Notice (Oregon Attorney General)

The personal information of an unknown number of Oregon residents was exposed in a breach at ASOS US Sales LLC on July 28, 2026. The company filed notice of the incident with the Oregon Department of Justice on September 09, 2026 — 43 days later.

If you received a letter, this is what it actually means

The filing states that personal information was involved. No passwords, no financial account numbers, no government identifiers such as Social Security numbers, and no medical data appear in the categories listed. That is genuinely good news. The exposure is narrower than many breach notifications, and the absence of the most dangerous identifiers reduces the long-term risk.

Still, the named personal information does not expire. Names combined with addresses, dates of birth, email addresses or phone numbers remain useful to identity thieves for years. They can support synthetic identity fraud, account takeover attempts on other services, or phishing campaigns that look more convincing because they contain real details about you.

What the 43-day gap tells us

The incident occurred on July 28 and the filing arrived on September 09. That interval is neither unusually fast nor unusually slow for breach notifications. State laws generally allow companies time to investigate and prepare notifications, so the gap alone does not prove delay or diligence. It simply marks the timeline you can see printed on this page.

The letter is the only reliable test

ASOS US Sales LLC is required to notify affected individuals directly, usually by mail. If you have not received a letter at your address on file as of July 28, 2026, it is likely your information was not included. However, if you have moved since the incident date, the letter may have gone to an old address. In that case, contact ASOS customer support directly to confirm whether your records were part of the incident.

Anyone named in this filing received, or should eventually receive, their own notice spelling out exactly which pieces of information were exposed for their specific record. The filing lists categories that applied to the incident overall, not to every person.

Why personal information stays risky long after the breach

Unlike a credit card that can be canceled or a password that can be changed, the core facts of your identity cannot be reissued. A date of birth stays the same forever. An address history can be reconstructed. These details help criminals pass verification questions on other websites, apply for credit in your name, or build convincing profiles for spear-phishing.

Because no passwords or credentials were exposed, this incident does not put your ASOS account itself at direct risk from credential-based attacks. The concern is downstream use of the personal details on other platforms and over time.

What you can still control

You cannot make the exposed data disappear, but you can limit what criminals can do with it. Monitoring for new account fraud and unexpected credit inquiries remains the most practical defense. Free annual credit reports from the three major bureaus let you check for accounts you did not open. Placing a fraud alert or credit freeze adds a stronger barrier that forces lenders to verify your identity before opening anything new.

Be especially wary of unsolicited calls, texts, or emails that reference your recent ASOS purchase or personal details. The breach makes it easier for scammers to sound legitimate. Verify any request by contacting the company through a known good channel rather than replying to the message.

Review your ASOS account security settings even though no credentials were lost. Enable any available additional verification steps and ensure the contact information on file is current so future notices reach you.

The limits of what this filing tells us

The record does not disclose how the breach occurred, whether customer data was taken by an outside party, or the precise fields exposed for each person. It also does not state how many people were affected. Those details remain outside the public filing. What matters most to you is contained in the letter you did or did not receive, and in the concrete steps you take now to watch for misuse of the personal information that can no longer be kept private.