HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountCredentialsMediumActive

NEIMAN MARCUS GROUP LTD LLC

bd_309db3af418e74bf · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 1, 2021

Filed

Sep 30, 2021

To disclose

9 weeks

Affected

4,027state residents only

Linked

3 filings

Confidence

66%

Full breach record for NEIMAN MARCUS GROUP LTD LLC →4 incidents on file

The Neiman Marcus Group, LLC notified Montana of a data breach where an unauthorized party obtained customer online account information starting in May 2020. Affected data included names, contact info, payment card numbers, and credentials. The company engaged cybersecurity experts and law enforcement, and mandated password resets for affected accounts.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 457 days

discovery → filing · 9 weeks / 60 days

May 1, 2020

Begins

Aug 1, 2021

Discovered

Sep 30, 2021

Filed

vs. sector median

+1 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Hawaii State AGbd_47222d23d11e2cc02021-09-30Verified
Maine State AGbd_86b40237d16b1df52021-09-30Verified

Name: NEIMAN MARCUS GROUP LTD LLC
norm: neiman marcus

Name: NEIMAN MARCUS GROUP LTD LLC
norm: neiman marcus
Industry: Retail & Consumerllm

Discovered: Aug 1, 2021
Breach occurred: May 1, 2020
Undetected for: 457 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 30, 2021
Affected individuals: 4,027state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: valid_credentials

During the incident: Engaged a leading cybersecurity expert
Notified law enforcement
Required an online account password reset for affected customers who had not changed their password since May 2020
Changes made: Continue to take actions to enhance system security and safeguard information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Hawaii State AGSep 30 · first

Maine State AGSep 30 · first

Montana State AGSep 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Data-Breach-Notification-14.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 30, 2021
Raw hash: f40b960e28480df7381fec82cc5b87318628492bff95d212617388590262d999

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNEIMAN MARCUS GROUP LTD LLC

Victim entityNEIMAN MARCUS GROUP LTD LLC

Incidentdiscovered Aug 1, 2021

Stated responseEngaged a leading cybersecurity expert

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov