MalwareRetail & ConsumerRetailRansomwareData EncryptedFinancial accountPIILowContained

Hudson’s Bay Company

bd_264a7510bfbd5700 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 29, 2018

Filed

Apr 27, 2018

To disclose

29 days

Affected

Not disclosed

Linked

4 filings

Confidence

66%

Full breach record for Hudson’s Bay Company →2 incidents on file

Hudson's Bay Company (HBC) notified the NH AG of a data security issue at Saks Fifth Avenue, Saks OFF 5TH, and Lord & Taylor locations. Malware ran on POS systems from July 1, 2017, collecting payment card data. HBC contained the issue on March 31, 2018, and offered credit monitoring. No SSN or PINs were affected. The number of affected individuals was not determined.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 271 days

discovery → filing · 29 days

Jul 1, 2017

Begins

Mar 29, 2018

Discovered

Apr 27, 2018

Filed

vs. sector median

3 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_65caec9530aacbd42018-04-27Candidate
Washington State AGbd_5e13507e894e1d642018-04-26 · +1dVerified
Oregon State AGbd_cec14f2140e6c5f82018-05-03 · +6dVerified

Name: Hudson’s Bay Company
norm: hudson s bay

Name: Hudson’s Bay Company
norm: hudson s bay
Industry: Retail & Consumerllm

Discovered: Mar 29, 2018
Breach occurred: Jul 1, 2017
Undetected for: 271 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 27, 2018
Affected individuals: Not disclosed
Data types: Financial accountPII
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial

During the incident: Engaged leading data security experts to conduct an investigation
Working with law enforcement authorities
Coordinating with the payment card companies
Contained the issue
Arranged with AllClear ID to provide potentially impacted customers with identity protection services
Changes made: Enhance the security of our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Washington State AGApr 26 · first

California State AG+1d

New Hampshire State AG+1d · this page

Oregon State AG+7d

Pattern: first filing Apr 26 (WA), last May 3 (OR) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hudsons-bay-20180427.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 27, 2018
Raw hash: a07be35a1e8d2f7a09184a2be08e7816a8944792ad856f5ee1e2717ddcfe5073

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHudson’s Bay Company

Victim entityHudson’s Bay Company

Incidentdiscovered Mar 29, 2018

Stated responseEngaged leading data security experts to conduct an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov