DisclosureLens
HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedIdentity (basic)Financial accountLowContained

ASOS plc

bd_a69235bbeaa283af · schema v1 · pii pii-v2

Severity

Low

Discovered

Jul 28, 2026

Filed

Aug 21, 2026

To disclose

24 days

Affected

Not disclosed

Linked

4 filings

Confidence

65%
Full breach record for ASOS plc

ASOS US Sales LLC detected unusual activity on July 28, 2026, and confirmed on July 29, 2026, that an unauthorized third party accessed customer accounts using login credentials obtained from an external source. Affected data included names, email addresses, delivery/billing addresses, phone numbers, redacted payment card details, social media account details, and dates of birth. The company blocked affected accounts, enforced password resets, and canceled suspicious transactions. No malware or ransomware was involved.

California clockDiscovered Jul 28, 2026Notified Aug 21, 202624d CA 30-day OK24 days discovery → filing

Incident timeline

discovery → filing · 24 days

Jul 28, 2026

Begins

Jul 28, 2026

Discovered

Aug 21, 2026

Filed

vs. sector median

5 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Filing propagation · 4 filings · 4 states

View merged incident ↗
Washington State AGAug 21 · first
Vermont State AGAug 21 · first
Texas State AGAug 21 · first
California State AGAug 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.