Citi Trends, Inc.

10-K Item 1C disclosure describing the registrant's cybersecurity risk management program and governance structure. The filing explicitly states no material cybersecurity incidents occurred in fiscal 2025 and no material risks from active cybersecurity threats have been identified. This is a programmatic Item 1C disclosure, not a breach notification.

Country : United States of America - Exfiltraded data : yes - Encrypted data : no

Citi Trends, Inc reported a data breach to the Montana Attorney General. The breach was reported on 2023-06-23. The breach occurred on 1/24/2023. 4 Montana residents were affected.

Citi Trends, Inc. reported a data breach to the Maine Attorney General affecting 285 Maine residents. The breach occurred on January 14, 2023, and was discovered on June 13, 2023. The incident involved an external system breach (hacking) resulting in the acquisition of names and Social Security Numbers. Citi Trends provided written notification and offered one year of identity theft protection services.

On or about January 14, 2023, an unauthorized third party entered and disrupted Citi Trends, Inc.'s IT network, gaining the ability to extract data including files containing employee and prospective employee information (names and other employment-related details). The company responded by changing passwords, blocking access, and engaging outside technical experts. Affected individuals were offered Experian credit monitoring and identity theft insurance.

Citi Trends, Inc. disclosed a ransomware incident involving Hive ransomware that disrupted back office and distribution center IT systems on January 14, 2023. The company activated its incident response plan and restored systems with FBI assistance. No sensitive customer data was retained on affected systems. The impact was not material to Q4 2022 results.