ASOS US Sales LLC Data Breach Notice (Washington Attorney General)

The filing from the Washington Attorney General establishes that on July 28, 2026, attackers obtained the names, full dates of birth, financial and banking information, email addresses, and password or security question answers of 1,929 people. The organisation notified the state 24 days later on August 21, 2026.

Your email address and password from ASOS are now in unknown hands

If you had an account with ASOS US Sales LLC, the combination of your email address and the associated password or security question answers was exposed. The record does not disclose whether those passwords were stored in hashed, encrypted, or plaintext form. Because that detail is unknown, treat the password as compromised and change it immediately everywhere you have reused it.

This is the part you can still control. Passwords can be updated. The exposure of that credential pair means anyone who obtained the data can attempt to log in to your ASOS account or any other service where you used the same email and password. Changing the password at ASOS and every other site that shares it is the single most effective step available to you right now.

Full dates of birth and financial details do not expire

The filing lists full date of birth and financial and banking information among the exposed categories. Neither of these can be changed the way a password or credit card number can. A date of birth combined with a name is frequently used by banks, insurers, and government agencies to verify identity over the phone or online. Once it is out, it remains a permanent piece of the identity puzzle that fraudsters can use for years.

Financial and banking information increases the immediate risk of fraudulent transactions or new account fraud. The record does not state the precise nature of the banking data, but its inclusion alongside names and dates of birth creates a credible profile for identity theft attempts that can surface long after the initial breach is forgotten.

What the 24-day timeline actually tells you

The incident occurred on July 28 and the filing reached the Washington Attorney General on August 21. That is a fast notification by most state standards. It does not prove the organisation had perfect detection capabilities, nor does it rule out the possibility that the data was accessed earlier. The filing simply gives these two dates and nothing between them. The speed of notification is the only timing fact the record supports.

No permanent government identifiers were exposed

The categories listed do not include Social Security numbers, driver’s license numbers, or any other government-issued identifiers that cannot be replaced. This is genuinely good news. You do not face the lifelong monitoring burden that comes with SSN exposure. The risks here centre on account takeover, identity verification abuse, and fraud tied to your name, date of birth, and financial details rather than irreplaceable government IDs.

How to determine whether this filing includes you

ASOS is required to notify affected Washington residents directly, usually by mail to the address they have on file. If you have not received a letter, it is likely your information was not part of the 1,929 records included in this incident. However, if you have moved since July 28, 2026, or if your contact details with ASOS are outdated, contact the company directly to confirm whether your records were involved.

The realistic long-term risks

With your full date of birth and name now outside your control, expect an increase in targeted phishing calls and emails that sound unusually personal. Fraudsters often use a correct date of birth early in a conversation to build credibility before attempting to extract more information or convince you to transfer money.

Financial and banking details raise the chance of unauthorised charges or attempts to open new accounts in your name. The password exposure means you must assume that any reused credential is now public. The combination of these elements creates a profile that remains useful to criminals for identity-related fraud for many years.

Concrete actions that address exactly these exposures

• Change your ASOS password immediately and enable two-factor authentication if available. Then update the same password anywhere else you reused it. This is the only exposure you can fully neutralise today.
• Review all financial accounts for unfamiliar activity. Check credit cards, bank accounts, and any linked payment methods for charges you do not recognise. Do this weekly for the next month.
• Place a fraud alert with the three major credit bureaus. A fraud alert requires lenders to verify your identity before opening new accounts. It is free, lasts one year, and directly counters the name-plus-date-of-birth combination now in circulation.
• Monitor your credit reports every four months. You are entitled to one free report from each bureau per year. Stagger them so you check Equifax, Experian, and TransUnion on a rotating schedule. Look specifically for accounts or inquiries you did not authorise.
• Treat unsolicited calls or messages that mention your date of birth as suspicious. Hang up or do not reply. Verify any purported organisation through a number or address you look up yourself rather than one provided in the message.

The record is narrow but clear. Your ASOS credentials can be replaced. Your date of birth and the financial details cannot. The practical difference between the two categories defines what you must protect now and what you must monitor for the foreseeable future. Acting on the changeable elements quickly is the most effective way to limit the damage from this specific incident.