Hudson’s Bay Co. says customer payment card information may have been stolen from shoppers at certain Saks Fifth Avenue, Saks Off Fifth, and Lord & Taylor stores in North America.
The retailer said in a statement that it has identified the issue and taken steps to contain it, but it has stopped short of disclosing how many payment card numbers were taken.
“Once we have more clarity around the facts, we will notify our customers quickly and will offer those impacted free identity protection services, including credit and web monitoring,” the statement said.
Five million records taken
However, one cybersecurity firm analyzed the available data and found that five million credit card and debit card numbers had been compromised in the breach.
Gemini Advisory LLC said in a report that the information was stolen from 83 Saks Fifth Avenue or Saks Off Fifth stores, and from all Lord & Taylor locations. Approximately 125,000 of the five million records compromised have been released for sale on the “dark web,” the firm said.
“Although at this moment it is close to impossible to ascertain the exact window of compromise, the preliminary analysis suggests that criminals were siphoning the information between May 2017 to present,” Gemini Advisory said.
Hudson Bay says it is “working rapidly with leading data security investigators to get customers the information they need, and the investigation is ongoing.” The company is coordinating with law enforcement authorities and the payment card companies for the investigation.
Consumers affected by the breach will not be liable for fraudulent charges, the company said.