Social EngineeringRetail & ConsumerRetailPhishingData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

CALERES, INC.

bd_5e8911f0c1cd538a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 27, 2026

Filed

Jun 15, 2026

To disclose

7 weeks

Affected

1state residents only

Confidence

66%

Full breach record for CALERES, INC. →3 incidents on file

Caleres, Inc. notified the New Hampshire Attorney General of a data event affecting one NH resident. Unauthorized access to an employee's Office 365 account occurred from March 23, 2026, to April 27, 2026, following a phishing incident. The resident's name and SSN were accessed. Caleres engaged forensic specialists, notified law enforcement, and provided 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 35 days

discovery → filing · 7 weeks / 49 days

Mar 23, 2026

Begins

Apr 27, 2026

Discovered

Jun 15, 2026

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: CALERES, INC.
norm: caleres
Industry: retail_consumer
Industry: Retail & Consumerllm

Discovered: Apr 27, 2026
Breach occurred: Mar 23, 2026 – Apr 27, 2026
Undetected for: 35 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 15, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the New Hampshire Attorney GeneralNotified federal law enforcement
Initial access: phishing_link

During the incident: Launched an investigation to confirm the full nature and scope of the activity with the assistance of industry-leading cybersecurity specialists
Notified federal law enforcement
Performed a comprehensive review of the impacted files
Provided written notice of this event to potentially affected individuals
Provided complimentary access to credit monitoring services for twenty-four (24) months, through IDX
Provided notified individuals with guidance on how to better protect against identity theft and fraud
Provided individuals with information on how to place a fraud alert and security freeze on one’s credit file
Provided contact details for the national consumer reporting agencies
Provided information on how to obtain a free credit report
Provided encouragement to contact the Federal Trade Commission, their state attorney general, and law enforcement
Changes made: Working to implement additional technical safeguards
Reviewing policies, procedures, and processes to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/caleres-20260615.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 15, 2026
Raw hash: 0cb36c767ed6a5a72c08762c86e574c52a522ed1f1b01146f6ed8c01cc7969dc

Reporting entityMullen Coughlin LLC

Victim entityCALERES, INC.

Incidentdiscovered Apr 27, 2026

Stated responseLaunched an investigation to confirm the full nature and scope of the activity with the assistance of industry-leading cybersecurity specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov