The fashion retailer Forever 21 has discovered a cyber incident that impacted a limited number of systems and exposed the personal information of more than 500,000 individuals. The study found that between January 5 and March 21 of 2023, threat actors had numerous points of access to specific Forever 21 systems. The exposed information includes names, Social Security numbers, dates of birth, bank account numbers (without access code or pin), and information regarding the Forever21 health plan, including enrollment and premiums paid. To prevent similar incidents from occurring in the future, the company announced it has implemented additional cyber security measures to protect its infrastructure. FOREVER 21 offered a complimentary 12-month membership of Experian’s® IdentityWorks℠ identity protection service.

The Maine Office of the Attorney General reported a data breach involving Forever 21 on August 29, 2023. The breach occurred between January 5, 2023, and March 21, 2023, due to an external hacking incident, affecting a total of 539,207 individuals, including 1,139 residents of Maine. The compromised information included Social Security numbers. Forever 21 is offering 12 months of Experian IdentityWorks identity theft protection services.

Over a period of seven months in 2018, Forever 21 experienced a significant cyber attack in which attackers gained access to the payment card data of an unspecified number of customers. The attackers achieved this access after infiltrating the network and deploying malware to extract credit card data from the fashion retailer's POS system. A key issue that emerged was Forever 21's failure to encrypt some of its POS devices, which contributed to the effectiveness of the data breach. The exact number of affected customers remains undisclosed, and while the total cost of the breach was not made public, Forever 21 settled a class-action lawsuit to cover claims for expenses and charges incurred as a direct result of the incident.

The California Office of the Attorney General reported a data breach incident involving Forever 21, Inc. on June 22, 2018. The breach involved unauthorized access to the email accounts of two employees of the third-party insurance broker, Willis Towers Watson, between February 15, 2018 and March 23, 2018, potentially exposing claim-related information of affected individuals.

The California Office of the Attorney General reported a data breach involving Forever 21, Inc. on December 28, 2017. The breach occurred from April 3, 2017 to November 18, 2017, and involved unauthorized access to payment card data from certain stores, affecting unspecified numbers of individuals with exposures including card numbers, expiration dates, and internal verification codes.

Forever 21, a US clothing retailer, revealed that there was a security breach at certain of its locations, resulting in the theft of payment card data. The company claims that unidentified hackers breach its payment systems and take credit cards that are used at some of its retail locations. The company acknowledged that, although it was only used at specific points of sale, it had adopted token-based authentication and encryption back in 2015. Customers are encouraged to keep a close eye on their payment card statements as unauthorised charges are still being investigated.