HackingRetail & ConsumerRetailVulnerability ExploitZero-DayData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

David Yurman Enterprises, LLC

bd_2154d2fd94c6e52c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 29, 2025

Filed

Nov 12, 2025

To disclose

6 weeks

Affected

1state residents only

Confidence

66%

Full breach record for David Yurman Enterprises, LLC →4 incidents on file

David Yurman Enterprises LLC notified the NH Attorney General of a data security incident involving a previously unknown vulnerability (zero-day) in Oracle E-Business Suite. Unauthorized access occurred between August 9-12, 2025. The breach affected the names and Social Security numbers of one New Hampshire resident (a current or former contractor). David Yurman secured the environment by applying an Oracle patch and offered complimentary identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 51 days

discovery → filing · 6 weeks / 44 days

Aug 9, 2025

Begins

Sep 29, 2025

Discovered

Nov 12, 2025

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: David Yurman Enterprises, LLC
norm: david yurman
Domain: davidyurman.com

Name: David Yurman Enterprises, LLC
norm: david yurman
Domain: davidyurman.com
Industry: Retail & Consumerllm

Discovered: Sep 29, 2025
Breach occurred: Aug 9, 2025 – Aug 12, 2025
Undetected for: 51 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 12, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Initial access: exploit_public_facing

During the incident: Conducted a thorough investigation with the help of experts
Promptly secured its Oracle EBS environment, including by applying a software patch issued by Oracle
Provided individuals with information about steps they can take to protect their personal information
Offered notified individuals the chance to enroll in complimentary identity protection services through Epiq
Changes made: Applied a software patch issued by Oracle
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(44 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/david-yurman-20251112.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 12, 2025
Raw hash: 5d3ca10ba11be5e3ef767dd64b5b0c98d500cbb5bcbbfe78da5c807fad30f54d

Reporting entityDavid Yurman Enterprises, LLC

Victim entityDavid Yurman Enterprises, LLC

Incidentdiscovered Sep 29, 2025

Stated responseConducted a thorough investigation with the help of experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov