HackingRetail & ConsumerRetailSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

STEIN MART, INC.

bd_f29c876cc79bf670 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Nov 27, 2018

To disclose

—

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for STEIN MART, INC. →3 incidents on file

Stein Mart, Inc. experienced a data breach between December 28, 2017, and July 9, 2018, due to unauthorized code in a third-party vendor's web application used on steinmart.com. The incident potentially exposed cardholders' names, addresses, email addresses, credit account numbers, security codes, and expiration dates. Synchrony Bank, the card issuer, notified affected customers, issued new cards, and offered credit monitoring. The unauthorized code and vendor login feature were removed.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 28, 2017

Begins

Nov 27, 2018

Filed

This filing is one of 6 about the same incident.View merged incident

Part of Social Annex, Inc. supply-chain incident (2018) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_fb11207da2b13acd2018-11-14 · +13dVerified
Montana State AGbd_7be7408ca16516132018-11-13 · +14dCandidate
California State AGbd_8a74ba926b9e0e7f2018-11-13 · +14dVerified
Washington State AGbd_dcd4b744c73963962018-11-13 · +14dVerified by operator

Show 1 more filing ↓up to 14d gap

Oregon State AGbd_f55c7eaa8530a3af2018-11-13 · +14dVerified by operator

Name: STEIN MART, INC.
norm: stein mart
Domain: steinmart.com

Name: STEIN MART, INC.
norm: stein mart
Domain: steinmart.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Dec 28, 2017 – Jul 9, 2018
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via Third-party vendor of Stein Mart, Inc.
Initial access: supply_chain

During the incident: Working with Stein Mart, Inc. to gather data
Removed unauthorized code from website
Removed third-party vendor’s login feature from the website
Issued new credit cards with updated security credentials
Offered one-year subscription to a credit report monitoring service at no cost
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Montana State AGNov 13 · first

California State AGNov 13 · first

Washington State AGNov 13 · first

Oregon State AGNov 13 · first

New Hampshire State AG+1d

California State AG+14d · this page

Pattern: first filing Nov 13 (MT), last Nov 27 (CA) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-142122
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 27, 2018
Raw hash: 3f6d5128cadf8d402927b051854e4a581de9b21f5a4f7f79ad007e37894ed333

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySTEIN MART, INC.

Victim entitySTEIN MART, INC.

IncidentThird-Party / Supply Chain

Stated responseWorking with Stein Mart, Inc. to gather data

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov