HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedData ExfiltratedIdentity (basic)Financial accountFinancial credentialsLowContained

MACY'S, INC.

bd_86b831fb90eeeebf · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 15, 2019

Filed

Nov 14, 2019

To disclose

4 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

64%

Full breach record for MACY'S, INC. →5 incidents on file

Macy's disclosed a data breach involving unauthorized access to macys.com. Between October 7 and October 15, 2019, an unauthorized third party injected malicious code into the checkout and wallet pages, capturing customer PII and payment card details. Macy's engaged law enforcement and forensic investigators, removed the code, and notified affected individuals, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 8 days

discovery → filing · 4 weeks / 30 days

Oct 7, 2019

Begins

Oct 15, 2019

Discovered

Nov 14, 2019

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_62eb603410b950862019-11-14Candidate
Washington State AGbd_e6318c97f5b749002019-11-14Verified
California State AGbd_31b96199e68e3d552019-11-15 · +1dVerified
Oregon State AGbd_49ff44d3a912f3e22019-11-15 · +1dVerified

Show 1 more filing ↓up to 1d gap

Massachusetts State AGbd_950c4ee838a9537b2019-11-15 · +1dVerified

Name: MACY'S, INC.
norm: macy s
Domain: macys.com

Name: MACY'S, INC.
norm: macy s
Domain: macys.com
Industry: Retail & Consumerllm

Discovered: Oct 15, 2019
Breach occurred: Oct 7, 2019
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 14, 2019
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Contacted federal law enforcement
Brought in a leading class forensics firm to assist in our investigation
Reported the relevant payment card numbers to the card brands (i.e. Visa, Mastercard, American Express, and Discover)
Removed the unauthorized code
Changes made: Arranged to have Experian IdentityWorks to provide you with its identity protection services for 12 months at no cost to you
Taken steps that we believe are designed to prevent this type of unauthorized code from being added to macys.com
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGNov 14 · first

Washington State AGNov 14 · first

Delaware State AGNov 14 · first · this page

California State AG+1d

Oregon State AG+1d

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2020/06/Macys.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 14, 2019
Raw hash: e806f75cd7c6511d67d5146c3c31b5a7533accb35c2d033bef3dd6ce6db47239

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMACY'S, INC.

Victim entityMACY'S, INC.

Incidentdiscovered Oct 15, 2019

Stated responseContacted federal law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov