MalwareRetail & ConsumerRetailRansomwareData ExfiltratedCustomer Data InvolvedPCIFinancial accountHighContained

MICHAELS STORES, INC.

bd_57e078010e175fe8 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 25, 2014

Filed

Apr 18, 2014

To disclose

12 weeks

Affected

3,000,000

Linked

2 filings

Confidence

64%

Full breach record for MICHAELS STORES, INC. →

Michaels Stores, Inc. filed a supplemental notice with the New Hampshire AG regarding a malware attack on POS systems at Michaels and Aaron Brothers stores. The incident affected approximately 3 million payment cards nationwide between May 2013 and Jan 2014. Payment card numbers and expiration dates were compromised. The incident is contained.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 262 days

discovery → filing · 12 weeks / 83 days

May 8, 2013

Begins

Jan 25, 2014

Discovered

Apr 18, 2014

Filed

vs. sector median

+4 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_a12900c0b9c4d4bd2014-01-27 · +81dCandidate

Name: MICHAELS STORES, INC.
norm: michaels stores
Domain: michaels.com

Name: MICHAELS STORES, INC.
norm: michaels stores
Domain: michaels.com
Industry: Retail & Consumerllm

Discovered: Jan 25, 2014
Breach occurred: May 8, 2013 – Jan 27, 2014
Undetected for: 262 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 25, 2014
Affected individuals: 3,000,000nationwide
Data types: PCIFinancial account
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Previously reported to New Hampshire Attorney General's office in a letter dated January 27, 2014
Initial access: external_remote_services

During the incident: Retained two independent, expert security firms to conduct an extensive investigation
Working closely with law enforcement authorities
Coordinating with banks and payment processors
Provided data about potentially affected payment cards to the relevant card brands
Offering identity protection, credit monitoring and fraud assistance services to affected customers for 12 months at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(83 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGJan 27 · first

New Hampshire State AG+81d · this page

Pattern: first filing Jan 27 (CA), last Apr 18 (NH) — a 81-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/michaels-stores-20140418.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 18, 2014
Raw hash: a1da6a0e4048cc17e213741da285c612e0123332c773dc152222044a8b4bc8d5

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMICHAELS STORES, INC.

Victim entityMICHAELS STORES, INC.

Incidentdiscovered Jan 25, 2014

Stated responseRetained two independent, expert security firms to conduct an extensive investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov