Forever 21
Disclosed Apr 20, 20179 years ago2,543 affectedConfirmed
What is known
| People affected | 2,543 (as reported by the organization) |
|---|---|
| Disclosed | Apr 20, 2017 |
| Discovered | Oct 1, 2017 |
| Happened | Feb 15, 2018 |
| Attack | Hacking |
| Data exposed | Names, Payment cards, Financial |
| Sector | Other · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Forever 21oag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Forever 21atg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Forever 21justice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2018 data breach report: Forever 21in.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: Forever 21maine.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Maine AGresidents of ME | Apr 20, 2017 | 1 |
| Indiana AGresidents of IN | Nov 14, 2017 | |
| California AGresidents of CA | Dec 28, 2017 | |
| Washington AGresidents of WA | Dec 28, 2017 | |
| Oregon DOJresidents of OR | Dec 28, 2017 | |
| California AGresidents of CA | Jun 1, 2018 | |
| California AGresidents of CA | Jun 22, 2018 |
History of this record
- 2026-09-25 · data_types: [] to ["names","payment-card","financial"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 2543 · backfill source
- 2026-09-25 · disclosed: 2017-11-14 to 2017-04-20 · backfill source
- 2026-09-25 · disclosed: 2017-12-28 to 2017-11-14 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2017-10-01 · backfill source
- 2026-09-25 · disclosed: 2018-06-01 to 2017-12-28 · backfill source
- 2026-09-25 · disclosed: 2018-06-22 to 2018-06-01 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.