Neiman Marcus told 4.6M customers a hacker took card data — its second big breach

Neiman Marcus disclosed that a hacker had obtained personal information from customers' online accounts, and began notifying about 4.6 million customers. The exposed data included names, contact information, credit card numbers and expiration dates, virtual gift card numbers, and usernames and passwords. The company said 3.1 million payment and virtual gift cards were affected, of which 85% were expired or invalid. It brought in cybersecurity firm Mandiant and law enforcement, required customers to reset passwords, and opened a dedicated call center.

It was the luxury retailer's second major breach in less than a decade. In 2019 it paid to settle claims over a 2013 breach that led to fraudulent use of thousands of credit cards. Retail Dive noted the recurrence pointed to the industry's wider problem — Thales' data security report found 71% of surveyed retail organizations had suffered a breach at some point, and retail led all sectors.

The timing was delicate: Neiman Marcus had emerged from Chapter 11 in 2020, and in June 2021 announced a $500 million digital transformation investment over three years, including the acquisition of SaaS platform Stylyze. As Retail Dive put it, cybersecurity 'was not on the list of its planned digital investments'. CEO Geoffroy van Raemdonck said after the breach that the company would 'continue to take actions to enhance our system security and safeguard information'.

4.6 million customers notified; 3.1 million payment and virtual gift cards affected, though 85% were expired or invalid.

A 2013 breach and its 2019 settlement had not translated into hardened defenses before this second, larger incident.

The company was racing to rebuild digitally after bankruptcy, and its announced investment priorities did not include cybersecurity.

Online accounts concentrated exactly the data attackers want — card numbers, gift card balances and password credentials — in one place.

Announcing half a billion dollars of digital investment while cybersecurity is not on the list is how a second breach happens within a decade of the first.

Neiman Marcus engaged Mandiant and law enforcement to investigate, forced password resets across affected accounts, and staffed a dedicated call center. The company said it would continue enhancing system security. The disclosure landed while the retailer was still raising capital and rebuilding after its 2020 Chapter 11, undercutting the digital-growth story it was marketing to customers and partners.