Macy's, Inc. macys.com Macy's data breach 2019: what happened and what to do
In October 2019 criminals added code to two macys.com pages that copied card and contact details typed in at checkout and in the account wallet. Macy's removed it on October 15 and hasn't said how many customers were affected.
View all 13,115 breaches- Breach date
- 7 Oct 2019
- Made public
- 14 Nov 2019
- Data exposed
- Names, Physical addresses, Phone numbers, Email addresses, Credit cards
- Last updated
Macy's disclosed in November 2019 that its website had been compromised. The data was taken as customers typed it in.
What happened
According to Macy's, an unauthorized party added code to two pages on macys.com on October 7, 2019: the checkout page and the wallet page in My Account. Macy's says it was alerted to a suspicious connection on October 15 and removed the code the same day. Security reporters described it as a Magecart-style card skimmer, though Macy's didn't use that term. The code only ran when someone entered a card number and clicked to place the order or save the card. Macy's says shoppers who used the mobile site or the app weren't affected. It called it an incident involving a small number of customers and hasn't published a count. The Washington Attorney General's office lists a notice with 3,810 residents of that state.
What was exposed
Macy's said the code could have captured names, addresses, phone numbers, email addresses, payment card numbers, security codes and expiration dates entered while it was live. A full card number with the security code can be used for online purchases.
What the company did
Macy's reported the incident to federal law enforcement, brought in a forensics firm, and shared the affected card numbers with the card networks. It notified affected customers by letter.
What to do if you were in it
- 1
Check card statements
Look at charges from October 2019 onward. Report anything unfamiliar to your card issuer and ask for a replacement card.
- 2
Turn on card alerts
Most banks can text you for each transaction.
- 3
Expect phishing that uses your name and address
Messages claiming to be from Macy's or your bank may include accurate details. Don't click links in them.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up, so you know what to act on. It can't remove data from a breach, but it tells you what to do next.
Frequently asked
Was I affected by the Macy's data breach?
Only people who entered a card on macys.com checkout or the My Account wallet page in the window were at risk. Macy's sent notices to the people involved.
What was exposed?
Names, addresses, phone numbers, email addresses, card numbers, security codes and expiration dates, according to Macy's.
Should I change my password?
Macy's didn't say passwords were taken. Changing your password is still a cheap precaution if you reuse it elsewhere.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
