Eddie Bauer eddiebauer.com Eddie Bauer data breach: what happened and what to do
Eddie Bauer said card-stealing malware ran on registers at its U.S. and Canadian stores. Cards used in stores between January 2 and July 17, 2016 may have been accessed. Online purchases were not affected. The company didn't give a total.
View all 13,177 breaches- Breach date
- 2 Jan 2016
- Data exposed
- Names, Credit cards
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
In August 2016, Eddie Bauer told customers that point-of-sale malware had run on cash registers at its stores in the U.S. and Canada. Security reporter Brian Krebs had asked the company about a fraud pattern in July. Eddie Bauer, working with the FBI and an outside forensics firm, said it detected and removed the malware.
The company said payment cards used at its stores between January 2 and July 17, 2016 may have been accessed, though not every transaction in that period was affected. Online purchases were not part of it. Eddie Bauer did not publish a total number of customers. The notice appears on the California and Washington Attorney General breach lists; Washington's resident count covers one state only and isn't a total.
Sources checked: bankinfosecurity.com, tripwire.com, oag.ca.gov
Last verified against the official page:
What was exposed
Reports say the malware captured the cardholder's name, card number, security code and expiration date.
The company's response
Eddie Bauer offered 12 months of identity protection through Kroll to customers who had made purchases or returns in that window, and said it worked with the FBI and the card networks.
What it means for you
Card data is the most fixable kind of exposure. Your bank can replace the card number. The risk is fraud on the card, not identity theft, unless you reused the same details elsewhere. Check your statements for that period.
What to do if you were in it
- 1
Place a free credit freeze
A freeze at Equifax, Experian and TransUnion blocks new accounts opened in your name. It's free, and the FTC explains how credit freezes and fraud alerts work.
- 2
Watch your statements and explanations of benefits
Look for charges, accounts or medical bills you don't recognize, and check your credit reports at annualcreditreport.com.
- 3
Report identity theft right away
If someone misuses your details, report it at IdentityTheft.gov to get a recovery plan.
- 4
Expect phishing that mentions the breach
Don't click links in unexpected messages. The FTC explains how to recognize and avoid phishing.
- 5
Check which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone. Serus monitors breach databases and the dark web and alerts you; it can't remove data from a breach.
Official filings
- Washington Attorney General , filed 18 Aug 2016 : 73,508 people
Timeline
-
The breach happened
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Eddie Bauer breach?
If you paid with a card in an Eddie Bauer store between January 2 and July 17, 2016, you may have been. Not every transaction was affected, and the company didn't give a total.
What was exposed?
Reports say cardholder names, card numbers, security codes and expiration dates.
Were online purchases affected?
No. The company said online purchases were not part of the incident.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
