HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

MACY'S, INC.

bd_31b96199e68e3d55 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 15, 2019

Filed

Nov 15, 2019

To disclose

4 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

65%

macys.com experienced a data breach between October 7 and October 15, 2019, where an unauthorized third party injected malicious code into checkout and wallet pages to capture customer PII and payment card data. The incident was contained on October 15, 2019. Affected data included names, addresses, phone numbers, email addresses, payment card numbers, and security codes. Macy's engaged forensic investigators, notified law enforcement, reported card numbers to card brands, and provided 12 months of free identity protection services via Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

California clockDiscovered Oct 15, 2019 → Notified Nov 14, 201930d ✓ CA 60-day OK4 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 8 days

discovery → filing · 4 weeks / 31 days

Oct 7, 2019

Begins

Oct 15, 2019

Discovered

Nov 15, 2019

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Oregon State AGbd_49ff44d3a912f3e22019-11-15Verified
Massachusetts State AGbd_950c4ee838a9537b2019-11-15Verified
Montana State AGbd_62eb603410b950862019-11-14 · +1dCandidate
Delaware State AGbd_86b831fb90eeeebf2019-11-14 · +1dVerified

Show 1 more filing ↓up to 1d gap

Washington State AGbd_e6318c97f5b749002019-11-14 · +1dVerified

Name: MACY'S, INC.
norm: macy s
Domain: macys.com

Name: MACY'S, INC.
norm: macy s
Domain: macys.com
Industry: Retail & Consumerllm

Discovered: Oct 15, 2019
Breach occurred: Oct 7, 2019 – Oct 15, 2019
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 14, 2019
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Submitted Breach Notification to California Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Contacted federal law enforcement
Brought in a leading class forensics firm to assist in our investigation
Reported the relevant payment card numbers to the card brands (i.e. Visa, Mastercard, American Express, and Discover)
Removed the unauthorized code
Changes made: Taken steps that we believe are designed to prevent this type of unauthorized code from being added to macys.com
Arranged to have Experian IdentityWorks to provide you with its identity protection services for 12 months at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: CA 60-day OK · 30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Oct 15, 2019
→ Notified: Nov 14, 2019
30d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Oct 15, 2019 → Notified: Nov 14, 2019	30d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGNov 14 · first

Delaware State AGNov 14 · first

Washington State AGNov 14 · first

Oregon State AG+1d

Massachusetts State AG+1d

California State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-184363
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 15, 2019
Raw hash: 2f0d30cfb962948cbcf0e067ba9b1341bd6bbfd21200f952b702c3a7558d828c

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMACY'S, INC.

Victim entityMACY'S, INC.

Incidentdiscovered Oct 15, 2019

Stated responseContacted federal law enforcement

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov