HackingRetail & ConsumerRetailCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Financial accountCredentialsAuthenticationLowActive

The Neiman Marcus Group LLC

bd_64f1e5518aec51d7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 1, 2021

Filed

Sep 30, 2021

To disclose

29 days

Affected

Not disclosed

Linked

9 filings

Confidence

64%

Full breach record for The Neiman Marcus Group LLC →4 incidents on file

The Neiman Marcus Group, LLC notified customers that an unauthorized party obtained personal information associated with certain online accounts in May 2020. The incident was discovered in September 2021. Affected data may include names, contact info, payment card numbers (without CVV), virtual gift card numbers, usernames, passwords, and security questions/answers. The company engaged cybersecurity experts, notified law enforcement, and required password resets for affected accounts. The investigation is ongoing.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 1, 2021 → Notified Sep 30, 202129d ✓ CA 60-day OK29 days discovery → filing

Incident timeline

undetected · 487 days

discovery → filing · 29 days

May 2, 2020

Begins

Sep 1, 2021

Discovered

Sep 30, 2021

Filed

vs. sector median

5 wks faster

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Indiana State AGbd_07b35f770d21dca72021-09-30Verified
Massachusetts State AGbd_1d3567c71e8a237a2021-09-30Verified
Delaware State AGbd_7461fbea0332a50a2021-09-30Verified
Oregon State AGbd_a670c8d958ef4cd02021-09-30Verified

Show 4 more filings ↓up to 272d gap

Washington State AGbd_c9c13c122b01f8b12021-09-30Verified
Maine State AGbd_3a2af85b6cddd9922021-10-01 · +1dVerified
New Hampshire State AGbd_bebd3db5bfb41f532021-10-04 · +4dVerified
Illinois State AGbd_432f7d547946f08c2021-01-01 · +272dCandidate

Name: The Neiman Marcus Group LLC
norm: the neiman marcus
Domain: neimanmarcus.com

Name: The Neiman Marcus Group LLC
norm: the neiman marcus
Domain: neimanmarcus.com
Industry: Retail & Consumerllm

Discovered: Sep 1, 2021
Breach occurred: May 2, 2020 – May 17, 2020
Undetected for: 487 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 30, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountCredentialsAuthentication
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Engaged a leading cybersecurity expert
Notified law enforcement
Required an online account password reset for affected customers who had not changed their password since May 2020
Changes made: Continue to take actions to enhance our system security and safeguard information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: CA 60-day OK · 29d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 1, 2021
→ Notified: Sep 30, 2021
29d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 1, 2021 → Notified: Sep 30, 2021	29d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+272d

Massachusetts State AG+272d

Delaware State AG+272d

Oregon State AG+272d

Washington State AG+272d

California State AG+272d · this page

Maine State AG+273d

New Hampshire State AG+276d

Pattern: first filing Jan 1 (IL), last Oct 4 (NH) — a 276-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-545944
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 30, 2021
Raw hash: 8b662aae642bcbd685a2274deea7cc53d521de120826298661f2ee2e83cbc7ff

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityThe Neiman Marcus Group LLC

Victim entityThe Neiman Marcus Group LLC

Incidentdiscovered Sep 1, 2021

Stated responseEngaged a leading cybersecurity expert

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov