HackingRetail & ConsumerRetailCustomer Data InvolvedTargetedIdentity (basic)Financial accountMediumContained

TIFFANY AND COMPANY

bd_cb857f15207092f7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 9, 2025

Filed

Sep 17, 2025

To disclose

8 days

Affected · nationwide

2,5905 in this filing

Linked

7 filings

Confidence

65%

Full breach record for TIFFANY AND COMPANY →3 incidents on file

Tiffany and Company experienced an external system breach (hacking) between May 12 and May 15, 2025. The incident compromised client names, addresses, emails, phone numbers, sales data, and gift card numbers/PINs. 2,590 individuals were affected, including 5 in Maine. The breach was discovered on September 9, 2025, and notifications were sent on September 16, 2025.

J jump to incidentP pin to compareR raw source

Date basis clock✓ Clock withheld · confirmation date8 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 120 days

discovery → filing · 8 days

May 12, 2025

Begins

Sep 9, 2025

Discovered

Sep 17, 2025

Filed

vs. sector median

8 wks faster

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_58634fcfca97ce8a2025-09-17Verified
Montana State AGbd_09bad66e2b8c1ca42025-09-16 · +1dCandidate
Indiana State AGbd_d1a29158faec76b32025-09-16 · +1dVerified
Vermont State AGbd_e19e0f25f58441822025-09-16 · +1dVerified

Show 2 more filings ↓up to 2d gap

Nebraska State AGbd_ef25a0a9294a271f2025-09-16 · +1dVerified
New Hampshire State AGbd_a6db0f367e8e0b382025-09-19 · +2dVerified

Name: TIFFANY AND COMPANY
norm: tiffany and
Domain: tiffany.com

Name: TIFFANY AND COMPANY
norm: tiffany and
Domain: tiffany.com
Industry: Retail & Consumerllm

Discovered: Sep 9, 2025
Breach occurred: May 12, 2025 – May 15, 2025
Undetected for: 120 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 16, 2025
Affected individuals: 2,590state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Launched an investigation with the assistance of leading external cybersecurity experts
Took steps to further enhance the protection of our systems and data
Coordinated with law enforcement authorities
Changes made: Enhance the protection of our systems and data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 days(8 days from discovery to filing)
Compliance flags: Clock withheld · confirmation date

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGSep 16 · first

Indiana State AGSep 16 · first

Vermont State AGSep 16 · first

Nebraska State AGSep 16 · first

Massachusetts State AG+1d

Maine State AG+1d · this page

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/47105f5d-2775-40c0-9634-52890313356c.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 17, 2025
Raw hash: 9182937e731ed11230ec966a1acec5cccb7740a7bb94a455b88088047c34c1b4

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityTIFFANY AND COMPANY

Victim entityTIFFANY AND COMPANY

Incidentdiscovered Sep 9, 2025

Stated responseLaunched an investigation with the assistance of leading external cybersecurity experts

ComplianceClock withheld · confirmation date

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov