HackingSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALSMediumResolved
DICK'S SPORTING GOODS, INC.
bd_e73f2f2d7c0e6e6b · schema v1 · pii pii-v1
Full breach record for DICK'S SPORTING GOODS, INC. →A.D. Starr, a subsidiary of Dick's Sporting Goods, Inc., reported a data breach that originated from a third-party vendor. The incident, described as an external system breach (hacking), occurred on September 18, 2020, and was discovered on March 1, 2022. It affected 3,185 individuals, compromising their names and financial account or credit/debit card numbers along with security codes, access codes, or PINs. Affected individuals were notified in writing on May 23, 2022, and offered 12 months of credit monitoring and identity theft resolution services from Experian.
Maine clockDiscovered Mar 1, 2022 → Filed with AG May 20, 202280d ⏱ ME AG >30d11 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3,185 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/e10ad4f0-0cfe-4383-b65c-e453759a5f29.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 20, 2022
- Raw hash
- 88e1831c342a64455fcbe5d1d16182c1d456bebe444eaa4e7b327307e8866cd8
Reporting entity
- Name
- DICK'S SPORTING GOODS, INC.norm: dick s sporting goods
- Domain
- dickssportinggoods.com
Victim entity
- Name
- DICK'S SPORTING GOODS, INC.norm: dick s sporting goods
- Domain
- dickssportinggoods.com
Incident
- Discovered
- Mar 1, 2022
- Materiality determined
- —
- Notification sent
- May 23, 2022
- Affected individuals
- 3,185
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALS
- Attack vector
- Third-Party / Supply Chain
Compliance
- Time to disclose
- 11 weeks(80 days from discovery to filing)
- Compliance flags
- ME AG >30d · 80dME resident >60d · 83d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Mar 1, 2022→ Filed with AG: May 20, 202280d 30 days (soft) ME AG >30d Maine Discovered: Mar 1, 2022→ Notified: May 23, 202283d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.