HackingRetail & ConsumerRetailEmployee Data InvolvedDelayed DiscoveryIdentity (basic)Government IDEmploymentMediumContained

Hibbett Retail, Inc.

bd_3aaf18826dcd3d80 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Apr 27, 2026

Filed

Sep 8, 2026

To disclose

19 weeks

Affected

52state residents only

Linked

6 filings

Confidence

70%

Full breach record for Hibbett Retail, Inc. →

Hibbett Retail, Inc. reported that an unknown third party gained unauthorized access to its computer systems between April 22 and April 25, 2026. The company discovered suspicious activity on April 27, 2026. The incident affected 52 New Hampshire residents, involving exposure of names, Social Security numbers, and dates of birth from personnel records. Hibbett engaged forensic experts, notified law enforcement, and implemented security enhancements to its Microsoft 365 environment.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 5 days

discovery → filing · 19 weeks / 134 days

Apr 22, 2026

Begins

Apr 27, 2026

Discovered

Sep 8, 2026

Filed

vs. sector median

+12 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_31479a6bc6b731ba2026-09-08Verified
California State AGbd_8a4da78343d555072026-09-08Candidate
South Carolina State AGbd_8d5a0afe07517aef2026-09-08Verified
Texas State AGbd_c137c8de1c0dc67c2026-09-09 · +1dVerified

Show 1 more filing ↓up to 7d gap

Massachusetts State AGbd_b5066654af575e412026-09-01 · +7dVerified

Name: Adam Griffin (on behalf of Hibbett Retail, Inc.)
norm: adam griffin on behalf of hibbett retail

Name: Hibbett Retail, Inc.
norm: hibbett retail
Industry: Retail & Consumerllm

Discovered: Apr 27, 2026
Breach occurred: Apr 22, 2026 – Apr 25, 2026
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 8, 2026
Affected individuals: 52state-resident count only
Data types: Identity (basic)Government IDEmployment
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the Attorney General of the State of New Hampshire

During the incident: Initiated an investigation
Notified law enforcement
Secured its systems
Engaged external forensic cybersecurity experts to assist with the investigation and to help ensure the security of its computer systems
Issued legal notices where required by applicable law on September 08, 2026
Provided credit monitoring and identity theft protection information and a dedicated hotline
Changes made: Implemented and is continuing to implement measures to enhance the security of its Microsoft 365 environment
Strengthening authentication and access controls through Intune Conditional Access
Restricting access to sensitive folders and enhancing Microsoft Teams security
Rotating and remediating credentials and API keys
Conducting vulnerability scanning, penetration testing, and a Microsoft 365 security assessment
Improving its password-management and data-retention practices
Providing employee security awareness communications
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(134 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGSep 1 · first

Washington State AG+7d

California State AG+7d

South Carolina State AG+7d

New Hampshire State AG+7d · this page

Texas State AG+8d

Pattern: first filing Sep 1 (MA), last Sep 9 (TX) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hibbett-retail-20260908.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 8, 2026
Raw hash: c64fdc1cb3e634a29cca33903795fc388ef83650304280791726ea9d3fc1f46c

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAdam Griffin (on behalf of Hibbett Retail, Inc.)

Victim entityHibbett Retail, Inc.

Incidentdiscovered Apr 27, 2026

Stated responseInitiated an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov