Staples
Disclosed Dec 19, 201411 years agoConfirmed
POS malware at 115 Staples stores exposes customer card data
Staples said malware deployed on point-of-sale systems at 115 of its more than 1,400 US stores may have allowed access to transaction data; the breach had first been reported under investigation in October 2014.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Dec 19, 2014 |
| Happened | Aug 10, 2014 |
| Attack | Hacking |
| Data exposed | Payment cards, Names |
| Sector | Retail · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Staplesoag.ca.gov · Official notice | Official notice |
| Staples Form 10-K for fiscal 2014sec.gov · SEC filing | SEC filing |
| Indiana Attorney General 2014 data breach report: Staplesin.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: Staplesmaine.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Dec 19, 2014 | |
| Researchtotal | Dec 19, 2014 | |
| Indiana AGresidents of IN | Dec 19, 2014 | |
| Maine AGresidents of ME | Jan 20, 2015 | 351 |
| Maine AGresidents of ME | Feb 18, 2015 | 3 |
History of this record
- 2026-09-25 · data_types: ["payment-card"] to ["payment-card","names"] · backfill source
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-date-Report-2014.pdf · backfill source
- 2026-09-25 · sector: other to retail · seed source
- 2026-09-25 · attack: unknown to hacking · seed source
- 2026-09-25 · data_types: [] to ["payment-card"] · seed source
- 2026-09-25 · summary: empty to Staples said malware deployed on point-of-sale systems at 115 of its more than 1,400 US stores may have allowed access to transaction data; the breach had first been reported under investigation in October 2014. · seed source
- 2026-09-25 · title: empty to POS malware at 115 Staples stores exposes customer card data · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.