HackingRetail & ConsumerRetailBrute ForceStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)Financial accountPCILowResolved

The Neiman Marcus Group LLC

bd_d5c0e0e41620837b · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Apr 17, 2017

To disclose

—

Affected

7state residents only

Linked

3 filings

Confidence

66%

All records for The Neiman Marcus Group LLC →4 incidents on file

Account takeover notice

The Neiman Marcus Group LLC notified customers of unauthorized access to their accounts. The filing says: “Unauthorized individuals began attempting to access Neiman Marcus Group customers’ online accounts on or about December 26, 2015 with respect to our Neiman Marcus, Bergdorf Goodman, Last Call, CUSP, and Horchow websites (collectively the “NMG websites”) by trying various login and password combinations using automated attacks.”

Neiman Marcus Group notified Montana residents of a security incident starting Dec 26, 2015, where unauthorized individuals used automated attacks to access customer online accounts. Intruders viewed names, contact info, email, purchase history, and full payment card numbers. NMG required password resets and provided one year of credit monitoring via ID Experts.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 26, 2015

Begins

Apr 17, 2017

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_6b8cd0e39acc73852017-04-14 · +3dVerified
Massachusetts State AGbd_9f781f6b6617b2fd2017-04-14 · +3dVerified

Name: The Neiman Marcus Group LLC
norm: the neiman marcus

Name: The Neiman Marcus Group LLC
norm: the neiman marcus
Industry: Retail & Consumerllm

Discovered: —
Account access: Dec 26, 2015
Materiality determined: —
Notification sent: Apr 12, 2017
Affected individuals: 7state-resident count only
Data types: PIIIdentity (basic)Financial accountPCI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1110 Brute ForceT1078 Valid AccountsT1114 Email CollectionT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Notified the companies that process payment cards
Required all known affected customers to change their password
Provided one year of MyIDCare services through ID Experts
Changes made: Protected online accounts by requiring a password reset
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGApr 14 · first

Massachusetts State AGApr 14 · first

Montana State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/NMG.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 17, 2017
Raw hash: a270fa8088f162567ede661edc7c682d28c1993d5ddf884775f6a9c6fffcce22

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityThe Neiman Marcus Group LLC

Victim entityThe Neiman Marcus Group LLC

IncidentUnauthorized Access

Stated responseNotified the companies that process payment cards

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov