Social EngineeringRetail & ConsumerRetailPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedCredentialsPIILowContained

Lowe's Companies, Inc.

bd_4c384f193d68f71b · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 2, 2024

Filed

Oct 15, 2024

To disclose

6 weeks

Affected

5state residents only

Linked

5 filings

Confidence

67%

Full breach record for Lowe's Companies, Inc. →3 incidents on file

Lowe’s Companies, Inc. notified the NH Attorney General of a phishing incident where unauthorized third-party access was gained to employee Workday accounts via fraudulent Google ads. Discovered Sept 2, 2024, the incident affected 5 NH residents, exposing usernames, passwords, and associated PII. Lowe’s reset passwords, disabled external Workday access, and is implementing MFA. Credit monitoring is offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 43 days

Sep 2, 2024

Discovered

Oct 15, 2024

Filed

vs. sector median

1 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_20610bb1de07b9e92024-10-12 · +3dVerified
Indiana State AGbd_101665e6d03b6f362024-10-09 · +6dVerified
Montana State AGbd_a69f411bf02abe4a2024-10-09 · +6dCandidate
Maine State AGbd_e46fdb98575430442024-10-09 · +6dVerified

Name: Lowe's Companies, Inc.
norm: lowe s companies

Name: Lowe's Companies, Inc.
norm: lowe s companies
Industry: Retail & Consumerllm

Discovered: Sep 2, 2024
Materiality determined: —
Notification sent: Oct 9, 2024
Affected individuals: 5state-resident count only
Data types: CredentialsPII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Provided notice to the Office of the Attorney General Consumer Protection Bureau pursuant to N.H. Rev. Stat. § 359-C:20(1)(B)
Initial access: phishing_link

During the incident: Activated its incident response procedures
Launched an investigation into the nature and scope of the incident
Reset Workday passwords for all impacted employees
Temporarily disabled the ability to make payment elections changes off Lowe’s network
Temporarily disabled access to Workday from outside of the Lowe’s network
Offering affected employees with of complimentary credit monitoring and identity theft protection services through Experian
Changes made: Expediting its ongoing implementation of an MFA solution for Workday access
Strengthening its Workday authentication protocols
Implementing PIN multi-factor authentication for Workday access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGOct 9 · first

Montana State AGOct 9 · first

Maine State AGOct 9 · first

Massachusetts State AG+3d

New Hampshire State AG+6d · this page

Pattern: first filing Oct 9 (IN), last Oct 15 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lowes-companies-20241015.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 15, 2024
Raw hash: b6d8ebfe29912215ece88c4f093e73658c622730cdcf743618e4dfdcef67b83c

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityLowe's Companies, Inc.

Victim entityLowe's Companies, Inc.

Incidentdiscovered Sep 2, 2024

Stated responseActivated its incident response procedures

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov