HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedData ExfiltratedFinancial accountFinancial credentialsIdentity (basic)LowContained

Five Below, Inc.

bd_20f8dcca1d05eba6 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 11, 2019

Filed

Feb 14, 2019

To disclose

5 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for Five Below, Inc. →3 incidents on file

Five Below, Inc. reported unauthorized access to payment card data on its website between November 13, 2018, and January 11, 2019. The company detected suspicious activity on January 11, 2019. Affected data includes name, address, payment card number, expiration date, and CVV. The company engaged a security firm, enhanced website security, and offered one year of identity monitoring via Experian.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 11, 2019 → Notified Feb 7, 201927d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

undetected · 59 days

discovery → filing · 5 weeks / 34 days

Nov 13, 2018

Begins

Jan 11, 2019

Discovered

Feb 14, 2019

Filed

vs. sector median

3 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_32b7aed6d7d584032019-02-14Candidate
Massachusetts State AGbd_02a872bf8000b8212019-02-15 · +1dVerified

Name: Five Below, Inc.
norm: five below
Domain: fivebelow.com

Name: Five Below, Inc.
norm: five below
Domain: fivebelow.com
Industry: Retail & Consumerllm

Discovered: Jan 11, 2019
Breach occurred: Nov 13, 2018 – Jan 11, 2019
Undetected for: 59 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 7, 2019
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Began an investigation with the assistance of a leading computer security firm
Enhanced the security measures for our website
Working with the payment card networks so that banks that issue payment cards can be made aware
Secured the services of Experian to offer a complimentary one-year membership of Experian’s IdentityWorks
Changes made: Further enhanced the security measures for our website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: CA 60-day OK · 27d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 11, 2019
→ Notified: Feb 7, 2019
27d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 11, 2019 → Notified: Feb 7, 2019	27d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGFeb 14 · first

California State AGFeb 14 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-144713
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 14, 2019
Raw hash: 0c30b77de1d167ecbcd43a81bcdc080c3ceceb81a08d317a54387b1c97fc5733

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFive Below, Inc.

Victim entityFive Below, Inc.

Incidentdiscovered Jan 11, 2019

Stated responseBegan an investigation with the assistance of a leading computer security firm

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov