HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)CredentialsLowContained

Eileen Fisher, Inc.

bd_38e61c74258cc867 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 14, 2021

Filed

Mar 1, 2023

To disclose

17 months

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for Eileen Fisher, Inc. →4 incidents on file

Eileen Fisher, Inc. notified consumers of unauthorized access to employee email accounts between July 2, 2021, and October 19, 2021. The breach may have exposed names and other data elements. The company secured its network, engaged third-party specialists, reported to law enforcement, and offered 24 months of identity monitoring services.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday17 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 104 days

discovery → filing · 17 months / 503 days

Jul 2, 2021

Begins

Oct 14, 2021

Discovered

Mar 1, 2023

Filed

vs. sector median

+64 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_47b3cd5e1910fe752023-03-06 · +5dVerified

Name: Eileen Fisher, Inc.
norm: eileen fisher

Name: Eileen Fisher, Inc.
norm: eileen fisher
Industry: Retail & Consumerllm

Discovered: Oct 14, 2021
Breach occurred: Jul 2, 2021 – Oct 19, 2021
Undetected for: 104 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 1, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Reported the incident to law enforcement and are cooperating with their investigationNotified applicable regulatory authorities, as required by law
Initial access: valid_credentials

During the incident: Secured our network
Launched an investigation with the assistance of third-party computer specialists
Reviewed impacted accounts
Conducted a diligent and comprehensive review of the entire contents of the impacted accounts
Reviewed our records to identify contact information for potentially impacted individuals
Reviewed and reinforced the security of our computing environment
Reviewing our security policies, procedures, and processes
Adding to our security systems
Rolling out additional workforce training
Reported the incident to law enforcement and are cooperating with their investigation
Notified applicable regulatory authorities, as required by law
Offering twenty-four (24) months of complimentary access to identity monitoring services through Kroll
Changes made: Reviewing our security policies, procedures, and processes
Adding to our security systems
Rolling out additional workforce training to reduce the likelihood of a similar future incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 months(503 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Vermont State AGMar 1 · first · this page

New Hampshire State AG+5d

Pattern: first filing Mar 1 (VT), last Mar 6 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-03-01-eileen-fisher-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 1, 2023
Raw hash: a31f04ca5edcd314cb994d3f7cbd3e9c49216ad65006afa3f756c2734592b0fc

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityEileen Fisher, Inc.

Victim entityEileen Fisher, Inc.

Incidentdiscovered Oct 14, 2021

Stated responseSecured our network

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov