The California Office of the Attorney General disclosed a data breach at Macy's, where unauthorized actors gained access to macys.com customer data. The incident, detected on October 7, 2019, involved the exposure of sensitive personal information, including customer names, addresses, phone numbers, email addresses, and payment card details. Macy's launched an investigation on October 15, 2019, after identifying a suspicious connection. The breach compromised financial and personally identifiable information (PII), posing risks of identity theft, fraud, and reputational harm. While the exact scale of the breach was not specified, the exposure of payment card data elevated the severity, as such details are high-value targets for cybercriminals. The incident underscored vulnerabilities in Macy's online security infrastructure, prompting concerns over customer trust and potential regulatory penalties under data protection laws like CCPA (California Consumer Privacy Act). No evidence suggested ransomware involvement, but the breach’s focus on customer financial data marked it as a high-impact cybersecurity failure.

The California Office of the Attorney General reported that Macy's, Inc experienced a data breach involving unauthorized access to customer online profiles on July 2, 2018. The breach, which started on April 26, 2018 and was detected on June 11, 2018, potentially affected customer names, addresses, phone numbers, email addresses, and debit or credit card numbers, although Social Security numbers and CVVs were not accessed.