Data breach affects over 60,000 Neiman Marcus customers
Hackers have been attempting to sell Neiman Marcus shopper data stolen in a recent database attack.
In a filing with the Maine Attorney General’s office, a law firm representing Dallas-based Neiman Marcus Group confirmed that an external data breach which occurred April 14, 2024 and was discovered May 24, 2024 impacted 64,472 people (including 184 Maine residents, necessitating the filing).
Neiman Marcus sent affected customers a letter stating that between April and May 2024, “an unauthorized third party gained access to a database platform used by Neiman Marcus Group.”
According to the letter, the types of personal information affected varied by individual, and included information such as name, contact information, date of birth, and Neiman Marcus or Bergdorf Goodman gift card number(s), without PINs.
The letter also states that Neiman Marcus took steps to contain the breach “promptly after learning of the issue,” such as disabling access to the relevant database platform, and has launched an investigation with the assistance of “leading cybersecurity experts” and also notified law enforcement.
Gift cards whose numbers were exposed in the hack are still valid, and can be redeemed in stores and online using the number and PIN (which was reportedly not exposed). At this time, Neiman Marcus is not offering any free identity theft protection services to customers whose information was exposed.
According to Bleeping Computer, this breach is related to a larger series of attacks aimed at companies using the Snowflake data platform. The stolen data was reportedly put up for sale for $150,000 on a hacker forum, but then removed.
In a statement to Bleeping Computer, Neiman Marcus acknowledged the breach.
"Neiman Marcus Group (NMG) recently learned that an unauthorized party gained access to a cloud database platform used by NMG that is provided by a third party, Snowflake," the Neiman Marcus Group said in the statement.
In emailed commentary to Chain Store Age, James McQuiggan, security awareness advocate at cybersecurity platform provider KnowBe4, said cybercriminals continue to leverage supply chain attacks via a data breach against a service provider for hundreds of organizations.
"Snowflake joined the breached organizations and was unaware when it was too late," McQuiggan said. "It presents an issue of concern for all organizations working with third-party vendors and how to secure against attacks through them. Organizations must ensure they address third-party risk management, enhance access controls for users and data connections, continually work to protect data, prepare for incidents, promote cyber hygiene, and continuously improve security measures. All of these go hand in hand with building the layers of defense to protect the trust of stakeholders and customers."
[Read more: Fraud rises in 2023 for businesses, consumers alike]