HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedData ExfiltratedIdentity (basic)Financial accountLowContained

Eileen Fisher, Inc.

bd_07551083dc03afc2 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 24, 2016

Filed

Nov 9, 2016

To disclose

16 days

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for Eileen Fisher, Inc. →4 incidents on file

Eileen Fisher, Inc. disclosed a data breach affecting customers who made purchases on eileenfisher.com between September 9 and October 24, 2016. Malicious code added to the website allowed unauthorized individuals to capture names, shipping/billing addresses, and credit card numbers during checkout. The company removed the code, engaged forensic investigators, and offered 12 months of identity monitoring via AllClear ID.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 45 days

discovery → filing · 16 days

Sep 9, 2016

Begins

Oct 24, 2016

Discovered

Nov 9, 2016

Filed

vs. sector median

5 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Oregon State AGbd_14199a240fd644802016-11-09Candidate
Montana State AGbd_669ebe1f9a968f362016-11-09Verified
Washington State AGbd_7ce569c59d55c2e52016-11-09Verified
New Hampshire State AGbd_827b808e69e953082016-11-09Verified

Name: Eileen Fisher, Inc.
norm: eileen fisher
Domain: eileenfisher.com

Name: Eileen Fisher, Inc.
norm: eileen fisher
Domain: eileenfisher.com
Industry: Retail & Consumerllm

Discovered: Oct 24, 2016
Breach occurred: Sep 9, 2016 – Oct 24, 2016
Undetected for: 45 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: External
Initial access: exploit_public_facing

During the incident: Working diligently with a leading forensics firm to explore the issue
Removed that malicious code
Excluded the unauthorized individuals from our website
Arranged to have AllClear ID assist customers with AllClear’s Identity Repair and Identity Theft Monitoring services for 12 months at no cost to you
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Oregon State AGNov 9 · first

Montana State AGNov 9 · first

Washington State AGNov 9 · first

New Hampshire State AGNov 9 · first

California State AGNov 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-64832
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 9, 2016
Raw hash: 5790180e9554cf01e377ee6471b771e7be8c536497bf8eb7e474733d477957f1

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityEileen Fisher, Inc.

Victim entityEileen Fisher, Inc.

Incidentdiscovered Oct 24, 2016

Stated responseWorking diligently with a leading forensics firm to explore the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov