HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryFinancial accountPIIMediumContained

Forever 21, Inc.

bd_cd685125b20a9d3e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 5, 2008

Filed

Sep 16, 2008

To disclose

6 weeks

Affected

98,930scope not determined

Confidence

64%

Full breach record for Forever 21, Inc. →6 incidents on file

Forever 21, Inc. notified the New Hampshire Attorney General on September 16, 2008, of a security breach involving unauthorized access to customer payment card data. The incident affected approximately 98,930 credit and debit card numbers, with transactions occurring between November 2003 and August 2007. The breach was discovered on August 5, 2008, after the U.S. Secret Service contacted the company regarding an indictment of three individuals. The compromised data included card numbers and expiration dates but excluded customer names and addresses. More than half of the affected cards were expired or inactive. Forever 21 engaged forensic consultants, worked with payment networks, and notified credit bureaus.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1714 days

discovery → filing · 6 weeks / 42 days

Nov 26, 2003

Begins

Aug 5, 2008

Discovered

Sep 16, 2008

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed98,930 affectedView incident

Name: Forever 21, Inc.
norm: forever 21

Name: Forever 21, Inc.
norm: forever 21
Industry: Retail & Consumerllm

Discovered: Aug 5, 2008
Breach occurred: Nov 26, 2003 – Aug 14, 2007
Undetected for: 1,714 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 16, 2008
Affected individuals: 98,930scope not determined
Data types: Financial accountPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Contacted by the U.S. Secret Service and was advised that our company was identified in the indictment
Initial access: valid_credentials

During the incident: Retained forensic consultants to help us examine the file data and our systems
Working with our acquiring bank and payment card networks to resolve the situation
Contacted the three principal credit reporting bureaus, Equifax, Experian and Trans Union, to advise them of the situation
Adopted additional proactive security measures and continue to regularly monitor our systems for intrusions
Changes made: Adopted additional proactive security measures
Regularly monitor our systems for intrusions
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/forever-21-20080916.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 16, 2008
Raw hash: 10bad53d1bac73c0a18f2fb76ea3c88548591d85da4dc99de979a3679426405d

Reporting entityForever 21, Inc.

Victim entityForever 21, Inc.

Incidentdiscovered Aug 5, 2008

Stated responseRetained forensic consultants to help us examine the file data and our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov