HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsAuthenticationLowContained

CLAIRE'S STORES, INC.

bd_ad6d37f5c0e9547a · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 11, 2020

Filed

Jul 8, 2020

To disclose

27 days

Affected

259state residents only

Linked

8 filings

Confidence

66%

Full breach record for CLAIRE'S STORES, INC. →2 incidents on file

Claire's Stores, Inc. notified the NH Attorney General of a security incident affecting 259 NH residents. Unauthorized code was added to the e-commerce site between April 7 and June 12, 2020, capturing checkout data including payment card details and PII. Claire's removed the code, engaged forensic investigators, notified law enforcement and the payment network, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 65 days

discovery → filing · 27 days

Apr 7, 2020

Begins

Jun 11, 2020

Discovered

Jul 8, 2020

Filed

vs. sector median

4 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Montana State AGbd_1bca0a4881aa6b3d2020-07-08Verified
Indiana State AGbd_329767b59e4ac0862020-07-08Verified
Washington State AGbd_4bebbee8953e194a2020-07-08Verified
Massachusetts State AGbd_624858b7a1d3f81f2020-07-08Verified

Show 3 more filings ↓up to 189d gap

California State AGbd_95d7b1867aaa13d42020-07-08Verified
Oregon State AGbd_ff2273383efef6cc2020-07-08Verified
Illinois State AGbd_7bd92737897373392020-01-01 · +189dCandidate

Name: CLAIRE'S STORES, INC.
norm: claire s stores

Name: CLAIRE'S STORES, INC.
norm: claire s stores
Industry: Retail & Consumerllm

Discovered: Jun 11, 2020
Breach occurred: Apr 7, 2020 – Jun 12, 2020
Undetected for: 65 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 8, 2020
Affected individuals: 259state-resident count only
Data types: Identity (basic)Financial accountFinancial credentialsAuthentication
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified the Attorney General of New Hampshire
Initial access: exploit_public_facing

During the incident: Identified and removed unauthorized code
Engaged a security firm
Reinforced the security of its site
Notified the payment cards network
Notified law enforcement
Notifying 259 New Hampshire residents via U.S. mail
Providing a telephone number for individuals to call with any questions
Changes made: Implemented additional security measures
Offering a complimentary one-year membership to Experian's IdentityWorks internet surveillance and identity theft insurance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+189d

Indiana State AG+189d

Washington State AG+189d

Massachusetts State AG+189d

California State AG+189d

Oregon State AG+189d

New Hampshire State AG+189d · this page

Pattern: first filing Jan 1 (IL), last Jul 8 (NH) — a 189-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/claires-stores-20200708.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 8, 2020
Raw hash: 004aa584277893b2ffacfb89775c16b671e7777b4cb4c3ab8da12e98abde37c6

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityCLAIRE'S STORES, INC.

Victim entityCLAIRE'S STORES, INC.

Incidentdiscovered Jun 11, 2020

Stated responseIdentified and removed unauthorized code

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov