HackingRetail & ConsumerRetailCustomer Data InvolvedPCIFinancial accountFinancial credentialsIdentity (basic)LowContained

Eddie Bauer

bd_0f9818a67b1c51e4 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Aug 18, 2016

To disclose

—

Affected

Not disclosed

Linked

7 filings

Confidence

64%

Full breach record for Eddie Bauer →

Eddie Bauer, LLC reported unauthorized access to point-of-sale systems at its retail stores between January 2, 2016, and July 17, 2016. Payment card information, including name, card number, security code, and expiration date, may have been compromised. Online purchases were not affected. The company engaged forensic experts, notified the FBI and payment card networks, and offered 12 months of identity protection services to affected customers.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 2, 2016

Begins

Aug 18, 2016

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Oregon State AGbd_0beaa4320009e3042016-08-18Candidate
New Hampshire State AGbd_380bb2dab0ef39ca2016-08-18Verified
Washington State AGbd_da7886c5b1e299c82016-08-18Verified
South Carolina State AGbd_c6a99fdf627fcdc42016-08-19 · +1dVerified

Show 2 more filings ↓up to 1d gap

Massachusetts State AGbd_db55231dd627ad722016-08-19 · +1dVerified
Montana State AGbd_e71f9c95613850672016-08-19 · +1dVerified

Name: Eddie Bauer
norm: eddie bauer
Domain: eddiebauer.com

Name: Eddie Bauer
norm: eddie bauer
Domain: eddiebauer.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Jan 2, 2016 – Jul 17, 2016
Materiality determined: —
Notification sent: Aug 18, 2016
Affected individuals: Not disclosed
Data types: PCIFinancial accountFinancial credentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Working closely with the FBI

During the incident: Initiated a full investigation with third-party digital forensic experts
Working closely with the FBI to identify the perpetrator(s)
Notified the payment card networks
Enhanced the security of our point of sale systems
Providing complimentary identity protection services for 12 months through Kroll
Changes made: Enhanced the security of our point of sale systems
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Oregon State AGAug 18 · first

New Hampshire State AGAug 18 · first

Washington State AGAug 18 · first

California State AGAug 18 · first · this page

South Carolina State AG+1d

Massachusetts State AG+1d

Montana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-63417
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 18, 2016
Raw hash: 39fb0034fb813b4fb0bb7a06ca72434a35e7830ab1b45363052595422ea66445

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityEddie Bauer

Victim entityEddie Bauer

IncidentUnauthorized Access

Stated responseInitiated a full investigation with third-party digital forensic experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov