Brown-Forman brown-forman.com Brown-Forman data breach: what happened and what to do
Brown-Forman, the maker of Jack Daniel's, found suspicious activity on its network on July 28, 2020 and learned on August 4 that criminals had stolen internal corporate records, including Social Security numbers of employees, former employees and beneficiaries.
View all 13,177 breaches- Breach date
- 28 Jul 2020
- Data exposed
- Social security numbers, Credit cards
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Brown-Forman Corporation is the Louisville spirits company behind Jack Daniel's. In its filing with the Maine Attorney General, the company says it discovered suspicious activity in its internal network on July 28, 2020 and began to investigate and contain it. On August 4, 2020 it learned that the criminals had stolen certain internal corporate records.
Sources checked: maine.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
Who was affected
The people affected were mainly current and former employees and their dependents and beneficiaries, whose data the company holds for benefits administration. The company did not publish a total in the sources used here. Its Maine filing counts 72 Maine residents, which is one state only and not a total.
What was exposed
The Maine filing says the information included Social Security numbers and, for some people, credit card information tied to an expired card. A listing on the California Attorney General's site describes employee and beneficiary data such as names, home and email addresses and job details.
What it means for you
A Social Security number alongside a name and address is what criminals need to open credit or file a false tax return. An expired card number carries little direct risk, but the surrounding details can make phishing convincing.
The company's response
Brown-Forman offered identity theft protection services to affected people, according to its filing.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and stops lenders from seeing your credit report, which blocks most new accounts in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. Check your reports at annualcreditreport.com for accounts you don't recognize.
- 2
Take the identity protection you were offered
The notice letter explains how to enroll. It alerts you to activity but doesn't block it, so keep the freeze on too.
- 3
File your taxes early
Filing early makes a fake return in your name harder. If the IRS rejects your return because one already exists, report it at IdentityTheft.gov.
- 4
Treat messages that mention the breach as suspect
Scammers quote real breach details to look legitimate. Don't click links or call numbers in unexpected messages. Go to the company's website yourself, and see the FTC's phishing guide.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details turn up, so you know when to repeat these steps.
Official filings
- California Attorney General , filed 25 Aug 2020
Timeline
-
The breach happened
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Brown-Forman breach?
If you are a current or former employee, dependent or beneficiary and received a notice letter, yes. If you think you should have, ask Brown-Forman's HR or benefits team.
What was exposed?
Its Maine filing names Social Security numbers and, for some people, credit card information tied to an expired card.
Should I freeze my credit?
If your Social Security number was in the notice, yes. A freeze is free and the FTC recommends it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
