MACY'S, INC.
bd_394c9bfca4d45f0d · schema v1 · pii pii-v1
All records for MACY'S, INC. →5 incidents on fileAccount takeover notice
MACY'S, INC. notified customers of unauthorized access to their accounts. The filing says: “Because we believe that the unauthorized third party used your valid username and password to login to your profile and the third party obtained your credentials from a source other than Macy’s, we strongly encourage you to change your password for any online account for which you used the same username and password.”
Macy's, Inc. disclosed that an unauthorized third party used valid customer usernames and passwords to access online profiles between April 26 and June 12, 2018. The attacker accessed names, addresses, phone numbers, emails, birthdays, and payment card numbers. Macy's blocked affected profiles, reported card numbers to major networks, and offered 12 months of identity protection services.
J jump to incidentP pin to compareR raw source
Incident timeline
Apr 26, 2018
Begins
Jun 11, 2018
Discovered
Jul 2, 2018
Filed
vs. sector median
7 wks faster
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- New Hampshire State AGbd_5df1dd8fcc86bf932018-07-02Verified
- Massachusetts State AGbd_aafec7407e6af25a2018-07-02Verified
- California State AGbd_df0d139238bc78a52018-07-02Verified
- Oregon State AGbd_d0d676c1d1a62f7f2018-07-03 · +1dVerified
Show 1 more filing ↓Show fewer ↑up to 1d gap
- Washington State AGbd_1b586ea053ae9b1e2018-07-01 · +1dCandidate
Filing propagation · 6 filings · 6 states
View merged incident ↗Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.