Neiman Marcus data breach affects millions

Millions of Neiman Marcus customers have had their personal and financial information exposed in a data breach. In a press release the company confirmed unauthorized access to customer online accounts.

According to the press release 4.6 million customers of Neiman Marcus Group stores, specifically Neiman Marcus and Last Call, are being notified about the data breach by email.

What information was stolen?

For affected customers, it’s always important to know what information the threat actor may have gotten hold off. The personal information for affected Neiman Marcus customers varied and may have included:

• Names and contact information
• Payment card numbers and expiration dates (without CVV numbers)
• Neiman Marcus virtual gift card numbers (without PINs)
• Usernames, passwords, and security questions and answers associated with Neiman Marcus online accounts.

What has Neiman Marcus done?

To investigate the matter Neiman Marcus has engaged Mandiant, an American cybersecurity firm, and notified law enforcement. The investigation is ongoing.

Neiman Marcus has also informed the affected customers, and forced an online account password reset for affected customers who haven’t changed their password since May 2020. Neiman Marcus promised to continue to take actions to enhance its system security, and safeguard information.

The company has set up a phone number—(866) 571-9725—and web page for concerned customers, although at the time of publishing the website is not currently working.

What you can do

If you know or suspect you may have been affected by this data breach there are a few things you can do.

The most important one is to change your password and make sure you have not re-used the same login credentials elsewhere online. If you have, you’ll need to change that too. The same is true for any security questions.

Scammers like to make the most of data breaches like this by sending out fake emails trying to trick you into giving them your login credentials, so make sure you go directly to the website to change your password.

Unlike Neiman Marcus, other companies have offered free credit and identity monitoring services as a conciliatory measure after a data breach. In this case you would have to pay for that yourself. Credit monitoring services can’t actually stop cybercriminals from stealing your identity, but they can alert you if someone opens up a line of credit under your name.

Think about it this way, these services alert you to changes on your credit report if you can’t be bothered to check your own credit report. If that’s the case, then you may want to consider signing up and paying someone else to monitor your credit file for you, but the bottom line is that these credit monitoring services are just that—monitoring services, not protection.

If you find any unauthorized transactions involving your payment cards then immediately contact the relevant payment card company or financial institution.

Customers are entitled under U.S. law to one free credit report annually from each of the three nationwide consumer reporting agencies. To order a free credit report, you can visit www.annualcreditreport.com or call 1-877-322-8228.

Attribution

As this is an ongoing investigation, there is not much information to be had about any details that may point to a certain threat actor. The stolen data may at some point surface for sale on underground forum or dark web marketplace.

If you are wondering if the login credentials have been made publicly available, you may be able to find them at the website Have I been pwned? The same is true for other credentials. In fact, it doesn’t hurt to check your email address there every so often.

There’s no reason to be ashamed if you find your email address there, as long as you don’t use it in combination with the same password anymore. If you do, then make sure you change it as soon as you can. You can use a password manager or password book to keep track of all your different passwords.

Stay safe, everyone!

The post Neiman Marcus data breach affects millions appeared first on Malwarebytes Labs.