HackingRetail & ConsumerRetailCapture Stored DataData ExfiltratedEmployee Data InvolvedPIIIdentity (basic)EmploymentLowContained

CITI TRENDS, INC.

bd_227f63a14d300e6a · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jun 22, 2023

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

72%

Full breach record for CITI TRENDS, INC. →5 incidents on file

On or about January 14, 2023, an unauthorized third party entered and disrupted Citi Trends, Inc.'s IT network, gaining the ability to extract data including files containing employee and prospective employee information (names and other employment-related details). The company responded by changing passwords, blocking access, and engaging outside technical experts. Affected individuals were offered Experian credit monitoring and identity theft insurance.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 14, 2023

Begins

Jun 22, 2023

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitehunters_internationalbd_2112802b15c240772024-04-03 · +287dCandidate

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_c4e60966447bb6e42023-06-22Verified

Name: CITI TRENDS, INC.
norm: citi trends
Domain: cititrends.com

Name: CITI TRENDS, INC.
norm: citi trends
Domain: cititrends.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Jan 14, 2023
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Employment
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 ChannelT1119 Automated Collection
Threat actor: External

During the incident: Investigated the incident immediately
Changed passwords and blocked the unauthorized access
Engaged outside technical experts to enhance the security of our systems
Undertook an extensive process of reviewing the potentially-impacted files for sensitive information
Notified affected individuals and offered credit monitoring through Experian
Changes made: Changed passwords
Blocked the unauthorized access
Engaged outside technical experts to enhance the security of our systems
Offering free credit monitoring and $1 million in identity theft insurance through Experian
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGJun 22 · first

California State AGJun 22 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-568353
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 22, 2023
Raw hash: 3afc3df309df6d176310330c10a895932d8a770c4c3eaca0ae651f2198368d30

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityCITI TRENDS, INC.

Victim entityCITI TRENDS, INC.

IncidentUnauthorized Access

Stated responseInvestigated the incident immediately

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov