Neiman Marcus neimanmarcus.com Neiman Marcus data breach: what happened and what to do
Attackers took Neiman Marcus customer data in April 2024 through its Snowflake cloud account. Have I Been Pwned lists 31,152,842 emails with names, phone numbers, birth dates, addresses and partial card data (not enough to make purchases).
View all 13,115 breaches- Breach date
- 14 Apr 2024
- Made public
- 27 Jun 2024
- Affected
- 31,152,842
- Data exposed
- Dates of birth, Email addresses, IP addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Neiman Marcus is an American luxury retailer, and its 2024 breach is one of a run of incidents that came from the same place: customer accounts at the cloud data company Snowflake.
What happened
According to Have I Been Pwned, the breach dates to 14 April 2024. In a filing with the Maine Attorney General, Neiman Marcus said it found the intrusion on 24 May 2024 and that it came from the attacks on Snowflake, which affected 165 organisations worldwide. The stolen data was later posted online, and Have I Been Pwned added it on 9 July 2024.
The numbers differ depending on who's counting. Have I Been Pwned counted 31,152,842 unique email addresses in the leaked data. Neiman Marcus's own notice to regulators, as press reported it, named a much smaller number of people, 64,472, whose information it considered affected. When you see a figure in the news, check whether it's a count of email addresses or a count of notified people.
What was exposed
The data in the leak held email addresses, names, phone numbers, physical addresses, dates of birth, IP addresses and purchase records. It also held partial credit card data. Have I Been Pwned notes that this partial card data is insufficient to make purchases.
The company's notice said what was affected varied from person to person and could include gift card numbers without PINs. It said gift cards remained valid.
What does that give a criminal? A name, a phone number, an address and a birth date together are the base of a convincing scam call or text. Purchase history makes a fake "order problem" email believable, especially from someone who really shops at a luxury retailer. A birth date also helps with identity checks, and it can't be changed.
What Neiman Marcus did
Neiman Marcus notified regulators and affected customers and said the incident traced back to the Snowflake attacks. It said its gift cards stayed valid. If you got a notice from the company, it's worth keeping, since it lists what was taken for you specifically.
What to watch for
Passwords aren't listed in the exposed data, so you don't have a reset to rush. The risk is messages and calls. Be sceptical of anything that mentions a Neiman Marcus or Bergdorf Goodman order, a gift card or a card ending in specific digits.
If you used the same email address across retail sites, it's likely in other breaches too, and each one adds a little more detail to a profile of you.
Why the Snowflake link matters
Neiman Marcus wasn't the only organisation caught in these attacks: Have I Been Pwned says they affected 165 organisations worldwide. That means one retailer's breach often arrives alongside others from the same campaign, all landing in the same criminal marketplaces. If you shop with several big brands, your details may have leaked more than once, and each leak adds another piece to a profile of you. Treat a message that mentions any of them with the same caution.
What to do if you were in it
- 1
Watch for fake order and gift card messages
Treat emails, texts and calls about a Neiman Marcus order, refund or gift card with suspicion. Go to the retailer's site directly instead of using a link.
- 2
Check your card statements
Partial card data can't buy anything on its own, but review your statements anyway and report charges you don't recognise to your card issuer.
- 3
Expect smishing and scam calls
Your phone number and address were exposed. Don't give codes or details to anyone who contacts you first, and hang up and call back on a known number.
- 4
Consider a credit freeze
Your birth date was exposed and it won't change. A free freeze at Equifax, Experian and TransUnion stops new credit being opened in your name.
- 5
Check which breaches include your email
Run a free Serus scan to see whether your email or phone number appears in this and other breaches.
Frequently asked
Was I affected by the Neiman Marcus breach?
If you've bought from Neiman Marcus, possibly. Have I Been Pwned lists 31,152,842 email addresses, and you can search yours there or run a free Serus scan.
What was exposed in the Neiman Marcus breach?
Email addresses, names, phone numbers, physical addresses, dates of birth, IP addresses, purchase records and partial credit card data. Have I Been Pwned says the card data isn't enough to make purchases.
Were my passwords stolen?
Passwords aren't in the list of exposed data. Use a unique password on every site anyway.
How did the breach happen?
Neiman Marcus traced it to the wider attacks on the Snowflake cloud service, which affected 165 organisations.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
