Company Details
macy
78,743
704,375
43
oraclecloud.com
17
MAC_2040553
Completed

Macy's Company CyberSecurity Posture
oraclecloud.comMacy's is America’s store for life. The largest retail brand of Macy's, Inc. (NYSE:M) delivers quality fashion at affordable prices to customers at approximately 640 locations in 43 states, the District of Columbia, Puerto Rico, and Guam, as well as to customers in more than 100 international destinations through leading e-commerce site macys.com. Macy's inspires fashion exploration and discovery through the most desired family of exclusive brands for her, for him, for the home, and via our dynamic mobile and social platforms. We know the power of celebration, demonstrated through decades of memorable experiences created during Macy's 4th of July Fireworks® and Macy's Thanksgiving Day Parade®, as well as spectacular fashion shows, culinary events, flower shows, and celebrity appearances. Macy's flagship stores – including New York City’s Herald Square – are internationally renowned and preeminent destinations for tourists. With the collective support of our customers and employees, Macy's builds community and helps make a difference in every market we serve, supporting local and national charities by giving nearly $50 million each year, plus 146,000 hours of volunteer service. For more than 160 years, Macy’s has, and continues to, make life shine brighter for our customers, colleagues, and communities.
Company Details
macy
78,743
704,375
43
oraclecloud.com
17
MAC_2040553
Completed
Between 700 and 749

Macy's Global Score (TPRM)XXXX

Description: The California Office of the Attorney General reported that Macy's, Inc experienced a data breach involving unauthorized access to customer online profiles on July 2, 2018. The breach, which started on April 26, 2018 and was detected on June 11, 2018, potentially affected customer names, addresses, phone numbers, email addresses, and debit or credit card numbers, although Social Security numbers and CVVs were not accessed.
Description: The California Office of the Attorney General disclosed a data breach at Macy's, where unauthorized actors gained access to **macys.com** customer data. The incident, detected on **October 7, 2019**, involved the exposure of sensitive personal information, including **customer names, addresses, phone numbers, email addresses, and payment card details**. Macy's launched an investigation on **October 15, 2019**, after identifying a suspicious connection. The breach compromised financial and personally identifiable information (PII), posing risks of identity theft, fraud, and reputational harm. While the exact scale of the breach was not specified, the exposure of payment card data elevated the severity, as such details are high-value targets for cybercriminals. The incident underscored vulnerabilities in Macy's online security infrastructure, prompting concerns over customer trust and potential regulatory penalties under data protection laws like **CCPA (California Consumer Privacy Act)**. No evidence suggested ransomware involvement, but the breach’s focus on customer financial data marked it as a high-impact cybersecurity failure.
Description: The Washington State Office of the Attorney General reported a data breach involving Macy's Inc. on November 14, 2019. The breach, discovered on October 15, 2019, occurred due to unauthorized computer code added to two webpages on October 7, 2019, potentially affecting 3,810 Washington residents and exposing personal information including names, addresses, and payment card details.


No incidents recorded for Macy's in 2025.
No incidents recorded for Macy's in 2025.
No incidents recorded for Macy's in 2025.
Macy's cyber incidents detection timeline including parent company and subsidiaries

Macy's is America’s store for life. The largest retail brand of Macy's, Inc. (NYSE:M) delivers quality fashion at affordable prices to customers at approximately 640 locations in 43 states, the District of Columbia, Puerto Rico, and Guam, as well as to customers in more than 100 international destinations through leading e-commerce site macys.com. Macy's inspires fashion exploration and discovery through the most desired family of exclusive brands for her, for him, for the home, and via our dynamic mobile and social platforms. We know the power of celebration, demonstrated through decades of memorable experiences created during Macy's 4th of July Fireworks® and Macy's Thanksgiving Day Parade®, as well as spectacular fashion shows, culinary events, flower shows, and celebrity appearances. Macy's flagship stores – including New York City’s Herald Square – are internationally renowned and preeminent destinations for tourists. With the collective support of our customers and employees, Macy's builds community and helps make a difference in every market we serve, supporting local and national charities by giving nearly $50 million each year, plus 146,000 hours of volunteer service. For more than 160 years, Macy’s has, and continues to, make life shine brighter for our customers, colleagues, and communities.

At PetSmart, we’ll do Anything for Pets. ❤️🐾 And the people who love them! Because we’re those people, too. Pets inspire and motivate us to bring our best selves to work each day. Our associates are devoted to ensuring that pets’ lives are happy and healthy. So, naturally, we’re devoted to ensuring

The cooperatively organized REWE Group is one of the leading trade and tourism groups in Germany and Europe. In 2023, the company generated a total external turnover of more than 92 billion euros. Founded in 1927, REWE Group operates with around 390,000 employees in 21 European countries. The sa
El Corte Inglés is a world leader in large department stores and a benchmark of Spanish distribution. With more than 70 years' experience, the Group has maintained from the outset a policy of customer service and an ongoing concern with adapting itself to suit the tastes and needs of society.

We are a fashion and lifestyle ecosystem connected to our customers through digital channels and more than 600 stores in Brazil, Argentina and Uruguay. From the beginning, everything we do is to enchant. This is how our story began, in 1965, conquering important milestones, and today we are the lead

Founded in 1973 in Bahrain, Landmark Group has grown to become one of the largest and most successful omnichannel retail and hospitality conglomerates, with presence across 17 countries in the Middle East, Africa, India and Southeast Asia. Based in the UAE since 1990, the Group owns and operates 21

تعتبر أسواق عبدالله العثيم امتداد لمؤسسة صالح العثيم التجارية، التي أسسها في عام 1376هـ ( 1956م ) الشيخ الراحل/ صالح العثيم " يرحمه الله "حيث افتتحت تلك المؤسسة موقعها الأول في قلب منطقة العمل التجاري آنذاك الرياض-حلة القصمان، وعملت في تجارة المواد الغذائية وفي عام 1401 هـ / 1980 م تم تأسيس شركة أسو
At Dollar Tree, it’s really all about the thrill of the hunt. As a Fortune 150 company and one of the nation’s leading value retailers, we operate more than 8,000 stores and 25 distribution centers across 48 contiguous U.S. states and five Canadian provinces. We hunt the world over to find the most

Welcome to Pick n Pay, where family values and customer-centricity converge to create an unparalleled shopping experience. Since 1967, when the visionary Raymond Ackerman championed the cause of consumers by acquiring the first few stores, the Ackerman family's dedication has steered our journey of

Since arriving in the UK in 1990, we’ve gone on to be one of the biggest (and the highest-paying) supermarkets in the game, with a team of 45,000 colleagues who make Everyday Amazing. We've been crowned the 'Retail Employer of the Year' at the Grocer Gold Awards four times, which is a testament to
.png)
A security researcher discovered a nasty flaw in Google Antigravity tool, the latest example of companies rushing out AI tools vulnerable to...
Use these Macy's coupons and discounts to save up to 70% on everything from kitchen appliances to beauty essentials during the department...
Here are 25 early offers from Macy's Black Friday sale for your home, wardrobe, beauty cabinet and kids.
The singing voices behind Netflix's KPop Demon Hunters group HUNTR/X will perform at the NYC parade on Nov. 27, 2025, joining a lineup of...
News and resources to keep you on the cutting edge of cybersecurity.
Macy's Inc. has appointed Robert Chavez, former Hermes Americas CEO, to the board. He faces challenges influencing strategy of the company...
Let's explore the SWOT Analysis of Macy's by understanding its strengths, weaknesses, opportunities, and threats.
In late 2024, retail giant Macy's revealed a shocking accounting scandal involving its parcel delivery expenses. It said a single employee...
NEW YORK (AP) — They're up, up and — almost — away. The massive helium balloons that will float through New York City for the Macy's...

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
The official website of Macy's is http://www.macysjobs.com?rx_source=linkedincompanypage.
According to Rankiteo, Macy's’s AI-generated cybersecurity score is 737, reflecting their Moderate security posture.
According to Rankiteo, Macy's currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
According to Rankiteo, Macy's is not certified under SOC 2 Type 1.
According to Rankiteo, Macy's does not hold a SOC 2 Type 2 certification.
According to Rankiteo, Macy's is not listed as GDPR compliant.
According to Rankiteo, Macy's does not currently maintain PCI DSS compliance.
According to Rankiteo, Macy's is not compliant with HIPAA regulations.
According to Rankiteo,Macy's is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Macy's operates primarily in the Retail industry.
Macy's employs approximately 78,743 people worldwide.
Macy's presently has no subsidiaries across any sectors.
Macy's’s official LinkedIn profile has approximately 704,375 followers.
Macy's is classified under the NAICS code 43, which corresponds to Retail Trade.
No, Macy's does not have a profile on Crunchbase.
Yes, Macy's maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/macy.
As of November 27, 2025, Rankiteo reports that Macy's has experienced 3 cybersecurity incidents.
Macy's has an estimated 15,247 peer or competitor companies worldwide.
Incident Types: The types of cybersecurity incidents that have occurred include Breach.
Detection and Response: The company detects and responds to cybersecurity incidents through an incident response plan activated with yes (investigation initiated on 2019-10-15)..
Title: Macy's Data Breach
Description: Unauthorized access to customer online profiles at Macy's, Inc.
Date Detected: 2018-06-11
Date Publicly Disclosed: 2018-07-02
Type: Data Breach
Attack Vector: Unauthorized Access
Title: Macy's Inc. Data Breach
Description: The Washington State Office of the Attorney General reported a data breach involving Macy's Inc. on November 14, 2019. The breach, discovered on October 15, 2019, occurred due to unauthorized computer code added to two webpages on October 7, 2019, potentially affecting 3,810 Washington residents and exposing personal information including names, addresses, and payment card details.
Date Detected: 2019-10-15
Date Publicly Disclosed: 2019-11-14
Type: Data Breach
Attack Vector: Unauthorized computer code
Title: Macy's Data Breach (2019)
Description: The California Office of the Attorney General reported that Macy's experienced a data breach involving unauthorized access to personal information on macys.com. The breach reportedly occurred on October 7, 2019, and information potentially accessed included customer names, addresses, phone numbers, email addresses, and payment card details. An investigation was initiated immediately on October 15, 2019, after the company detected a suspicious connection.
Date Detected: 2019-10-15
Type: Data Breach
Common Attack Types: The most common types of attacks the company has faced is Breach.

Data Compromised: Customer names, Addresses, Phone numbers, Email addresses, Debit or credit card numbers

Data Compromised: Names, Addresses, Payment card details

Data Compromised: Customer names, Addresses, Phone numbers, Email addresses, Payment card details
Systems Affected: macys.com
Identity Theft Risk: High (PII and payment card details exposed)
Payment Information Risk: High (payment card details exposed)
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Customer Names, Addresses, Phone Numbers, Email Addresses, Debit Or Credit Card Numbers, , Names, Addresses, Payment Card Details, , Personal Information, Payment Card Details and .

Entity Name: Macy's, Inc.
Entity Type: Retail
Industry: Retail
Location: California

Entity Name: Macy's Inc.
Entity Type: Retail
Industry: Retail
Location: Washington
Customers Affected: 3810

Entity Name: Macy's, Inc.
Entity Type: Retailer
Industry: Retail
Location: United States (California)

Incident Response Plan Activated: Yes (investigation initiated on 2019-10-15)
Incident Response Plan: The company's incident response plan is described as Yes (investigation initiated on 2019-10-15).

Type of Data Compromised: Customer names, Addresses, Phone numbers, Email addresses, Debit or credit card numbers
Personally Identifiable Information: customer namesaddressesphone numbersemail addresses

Type of Data Compromised: Names, Addresses, Payment card details
Number of Records Exposed: 3810
Personally Identifiable Information: namesaddresses

Type of Data Compromised: Personal information, Payment card details
Sensitivity of Data: High
Data Exfiltration: Likely (unauthorized access reported)
Personally Identifiable Information: Yes (names, addresses, phone numbers, email addresses)

Regulatory Notifications: California Office of the Attorney General

Source: California Office of the Attorney General

Source: Washington State Office of the Attorney General

Source: California Office of the Attorney General
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: California Office of the Attorney General, and Source: Washington State Office of the Attorney General, and Source: California Office of the Attorney General.

Investigation Status: Initiated (as of 2019-10-15)
Most Recent Incident Detected: The most recent incident detected was on 2018-06-11.
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2019-11-14.
Most Significant Data Compromised: The most significant data compromised in an incident were customer names, addresses, phone numbers, email addresses, debit or credit card numbers, , names, addresses, payment card details, , customer names, addresses, phone numbers, email addresses, payment card details and .
Most Significant System Affected: The most significant system affected in an incident was macys.com.
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were payment card details, debit or credit card numbers, email addresses, phone numbers, addresses, names and customer names.
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 381.0.
Most Recent Source: The most recent source of information about an incident are Washington State Office of the Attorney General and California Office of the Attorney General.
Current Status of Most Recent Investigation: The current status of the most recent investigation is Initiated (as of 2019-10-15).
.png)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.

Get company history
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.