HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)MediumContained

European Wax Center, Inc.

bd_db8ef883638ca5e6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 18, 2023

Filed

May 25, 2023

To disclose

5 weeks

Affected

1,592state residents only

Confidence

70%

Full breach record for European Wax Center, Inc. →

European Wax Center, Inc. reported a data breach in Washington affecting 1,592 residents. On April 18, 2023, a threat actor used stolen credentials to access a staging site managed by third-party provider Zenoti. The actor exfiltrated files containing names and dates of birth. EWC implemented MFA, disabled accounts, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d5 weeks discovery → filing

Incident timeline

discovery → filing · 5 weeks / 37 days

Apr 18, 2023

Begins

Apr 18, 2023

Discovered

May 25, 2023

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,592 affectedView incident

Name: European Wax Center, Inc.
norm: european wax center

Name: European Wax Center, Inc.
norm: european wax center
Industry: Retail & Consumerllm

Discovered: Apr 18, 2023
Breach occurred: Apr 18, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 25, 2023
Affected individuals: 1,592state-resident count only
Data types: Identity (basic)
Data elements: NameDate of birth
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via Zenoti
Initial access: valid_credentials

During the incident: Zenoti decommissioned the stage site
Zenoti enlisted Site Reliability engineering and product teams to conduct incident analysis
EWC identified the intruder’s IP address and login location
EWC checked login activity for all users against those identifiers
Zenoti restricted access to the staging environment to only necessary individuals
Zenoti deleted the compromised account
Zenoti disabled all other accounts to that system
EWC began implementing Multi-Factor Authentication (MFA) across its systems
EWC will institute training sessions for all franchisees affected by the addition of MFA
EWC is conducting supplemental dark web monitoring
EWC began mailing written notice to impacted individuals on May 25
Providing individuals whose personal information was potentially affected with access to credit monitoring services for 12 months through Experian at no cost
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Implementing Multi-Factor Authentication (MFA) across its systems
Instituting training sessions for all franchisees affected by the addition of MFA
Conducting supplemental dark web monitoring for the presence of the potentially exposed information
Restricted access to the staging environment to only necessary individuals
Deleted the compromised account
Disabled all other accounts to that system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24241.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 25, 2023
Raw hash: ad47b11614f72108e44e94256819037b80098b2a1ebbdf588412fd62e97ed025

Reporting entityEuropean Wax Center, Inc.

Victim entityEuropean Wax Center, Inc.

Incidentdiscovered Apr 18, 2023

Stated responseZenoti decommissioned the stage site

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com