MisusePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedFINANCIAL_ACCOUNTPIILowContained
Chico's FAS, Inc
bd_d09028d39b4828c2 · schema v1 · pii pii-v1
Full breach record for Chico's FAS, Inc →Chico's FAS, Inc. disclosed that a former call center contractor, employed from May 22 to August 10, 2023, inappropriately captured and used customer payment card information provided over the phone. The incident was discovered on August 8, 2023. The contractor was terminated, and the relationship with the staffing agency was ended. Security protocols with contractors are being enhanced. No SSN or driver's license data was involved.
Vermont clock⏱ VT AG >14 bday8 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_209c7e8c5a06aa64Montana State AGfiled 2023-10-02Candidate
- bd_f2668d6b66a15e29New Hampshire State AGfiled 2023-10-02Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-10-02-chicos-fas-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 2, 2023
- Raw hash
- b7d5b6827f014eca8dd07a76460fa5fe850324b93306697cbcb43f03b20feb4f
Reporting entity
- Name
- Chico's FAS, Incnorm: chico s fas
Victim entity
- Name
- Chico's FAS, Incnorm: chico s fas
Incident
- Discovered
- Aug 8, 2023
- Materiality determined
- —
- Notification sent
- Oct 2, 2023
- Affected individuals
- Not disclosed
- Data types
- FINANCIAL_ACCOUNTPII
- Attack vector
- Insider
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- InternalFinancial
- Initial access
- insider_action
Compliance
- Time to disclose
- 8 weeks(55 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.