Social EngineeringRetail & ConsumerRetailPhishingTargetedCustomer Data InvolvedIdentity (basic)Government IDHighContained

Christian Dior Couture

bd_06928ec5a1bbc596 · schema v1 · pii pii-v1

Severity

High

Discovered

May 7, 2025

Filed

Jul 18, 2025

To disclose

10 weeks

Affected

10,878state residents only

Linked

8 filings

Confidence

70%

Full breach record for Christian Dior Couture →

Christian Dior Couture SAS reported a cybersecurity incident to the Washington AG. Unauthorized access occurred on Jan 26, 2025, via phishing, affecting client data including names, DOB, government IDs, and SSNs. Discovered May 7, 2025. 10,878 WA residents notified. Incident contained; no evidence of further access.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d10 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 101 days

discovery → filing · 10 weeks / 72 days

Jan 26, 2025

Begins

May 7, 2025

Discovered

Jul 18, 2025

Filed

vs. sector median

+3 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Indiana State AGbd_128ca2cb188780d92025-07-18Verified
California State AGbd_3990d88907e23e272025-07-18Verified
Massachusetts State AGbd_3ef039b218b11cf32025-07-18Verified
Vermont State AGbd_a9ded4e6ed2d71c32025-07-18Verified

Show 3 more filings ↓up to 4d gap

Oregon State AGbd_e4909a3b5a1f18852025-07-18Verified
New Hampshire State AGbd_055af7f259a18f662025-07-21 · +3dVerified
Texas State AGbd_1bf5e0c2136c5c482025-07-22 · +4dVerified

Name: Christian Dior Couture
norm: christian dior couture
Domain: dior.com

Name: Christian Dior Couture
norm: christian dior couture
Domain: dior.com
Industry: Retail & Consumerllm

Discovered: May 7, 2025
Breach occurred: Jan 26, 2025
Undetected for: 101 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 18, 2025
Affected individuals: 10,878state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security numberDate of birthPassport number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 0d
WA-stated discovery: Found after the fact
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Initial access: phishing_link

During the incident: Conducted an investigation, supported by leading third-party cybersecurity experts
Took steps to contain the incident
Notified law enforcement
Offering a complimentary 24-month membership of Experian IdentityWorksSM credit monitoring
Changes made: Taken steps designed to enhance network security and help prevent future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(72 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Indiana State AGJul 18 · first

California State AGJul 18 · first

Massachusetts State AGJul 18 · first

Vermont State AGJul 18 · first

Oregon State AGJul 18 · first

Washington State AGJul 18 · first · this page

New Hampshire State AG+3d

Texas State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34049.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 18, 2025
Raw hash: 1d9ad4947c47fde961eb17215f6921c0746940b45efa640fa381b343d12ce817

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityChristian Dior Couture

Victim entityChristian Dior Couture

Incidentdiscovered May 7, 2025

Stated responseConducted an investigation, supported by leading third-party cybersecurity experts

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com