HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedAuthenticationIdentity (basic)MediumContained

DICK'S SPORTING GOODS, INC.

bd_21be717c2a543a62 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 21, 2024

Filed

Sep 17, 2024

To disclose

27 days

Affected

72,012state residents only

Linked

2 filings

Confidence

71%

Full breach record for DICK'S SPORTING GOODS, INC. →2 incidents on file

DICK'S Sporting Goods, Inc. reported a cyberattack in Washington affecting 72,012 residents. Unauthorized third-party access occurred between August 21-22, 2024. Customer PII (name, address, email, phone, DOB) was acquired. The company terminated access, investigated, notified law enforcement, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d27 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 27 days

Aug 21, 2024

Begins

Aug 21, 2024

Discovered

Sep 17, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

SEC 8-Kbd_99f6b9f6d5b909f12024-08-28 · +20dCandidate

Name: DICK'S SPORTING GOODS, INC.
norm: dick s sporting goods
Domain: dickssportinggoods.com

Name: DICK'S SPORTING GOODS, INC.
norm: dick s sporting goods
Domain: dickssportinggoods.com
Industry: Retail & Consumerllm

Discovered: Aug 21, 2024
Breach occurred: Aug 21, 2024 – Aug 22, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 17, 2024
Affected individuals: 72,012state-resident count only
Data types: Identity (basic)
Data elements: NameDate of birthUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: reported this incident to federal law enforcement and certain state regulators
Initial access: valid_credentials

During the incident: Launched an internal investigation
Took action to terminate the unauthorized access
Remediate affected systems
Ascertain if any customer or employee data was impacted
Reported this incident to federal law enforcement and certain state regulators
Offering complimentary access to Experian IdentityWorks for 12 months
Changes made: Implementing additional security measures designed to defend against similar attacks in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

SEC 8-KAug 28 · first

Washington State AG+20d · this page

Pattern: first filing Aug 28, last Sep 17 (WA) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA30601.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 17, 2024
Raw hash: 4de501e26f7df234a94104e0fd1913f35152d7a97a8c93a9d3ed450708e35e61

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityDICK'S SPORTING GOODS, INC.

Victim entityDICK'S SPORTING GOODS, INC.

Incidentdiscovered Aug 21, 2024

Stated responseLaunched an internal investigation

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com