Herff Jones herffjones.com Herff Jones data breach 2021: what happened and what to do
Herff Jones, the graduation gown, yearbook and class ring maker, found suspicious payment card activity on April 7, 2021. The New York Attorney General says at least 206,925 cardholders had names, card numbers, CVVs and contact details taken.
View all 13,177 breaches- Breach date
- 7 Apr 2021
- Affected
- 206,925
- Data exposed
- Names, Credit cards, Email addresses, Physical addresses, Phone numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Herff Jones makes graduation caps and gowns, yearbooks and class rings, so its customers are mostly students and their families. On April 7, 2021, the company became aware of suspicious activity involving customers' payment card information. It notified law enforcement and hired an outside cybersecurity firm. Graduating students later reported fraudulent charges on their cards, and Herff Jones publicly acknowledged the payment card breach in May 2021.
What was exposed
According to the New York Attorney General, an attacker took data on at least 206,925 cardholders. It included names, credit card numbers, CVV codes, expiration dates, email addresses, mailing addresses and phone numbers.
Card numbers with CVVs can be used for online purchases until the card is replaced. The email addresses and phone numbers give scammers what they need for convincing messages, such as a fake notice about a graduation order or a refund.
The company's response
Herff Jones began notifying affected people on June 15, 2021 and offered complimentary credit monitoring and identity protection. The New York and Pennsylvania attorneys general later reached a settlement with the company, with $100,000 going to each office, after finding it had not met the Payment Card Industry Data Security Standard.
Sources checked: consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Ask your card issuer for a new card
If you paid Herff Jones by card in the affected period, call the number on the back of the card and ask for a replacement. Review recent statements and dispute any charge you don't recognize.
- 2
Turn on transaction alerts
Most banks can text or email you for every card charge. That catches fraud within minutes instead of at the next statement.
- 3
Take the free monitoring if you were offered it
The notice letter explains how to enroll. The FTC recommends using free credit monitoring when a company offers it after a breach.
- 4
Expect scams that mention the breach
Contact details tied to a real company make phishing emails, texts and calls more convincing. Don't click links or give out information on an unexpected message. Contact the company using a number from its official website instead.
Official filings
- Washington Attorney General , filed 16 Jun 2021 : 17,316 people
Timeline
-
The breach happened
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Herff Jones breach?
If you got a notice letter, yes. The New York Attorney General counts at least 206,925 cardholders. If you used a card on Herff Jones's site around graduation in 2021, check your statements and ask your card issuer.
What was exposed?
Names, card numbers, CVV codes, expiration dates, email addresses, mailing addresses and phone numbers, per the New York Attorney General.
Is there a settlement?
The New York and Pennsylvania attorneys general settled with Herff Jones, which agreed to pay $100,000 to each office. Those payments go to the states.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
