Forever 21 forever21.com Forever 21 data breach: what happened and what to do
Malware ran on some Forever 21 point-of-sale systems in U.S. stores at times between April 3 and November 18, 2017. It could capture card numbers, expiry dates and verification codes, and sometimes cardholder names. The company didn't publish how many customers were affected.
View all 13,177 breaches- Breach date
- 3 Apr 2017
- Data exposed
- Credit cards
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Forever 21 is a fast-fashion retailer with stores across the United States. In late 2017 it told customers that criminals had put malware on some of its in-store payment systems.
What happened
Forever 21 said malware was installed on some point-of-sale devices in U.S. stores at different times between April 3, 2017 and November 18, 2017. The company had started encrypting card data at checkout in 2015, but its investigation found that encryption was switched off on some devices in certain stores. That gap let the malware read card data.
Not every device in an affected store was infected, and not every store was affected for the whole period. Forever 21 didn't say how many customers were involved. In some cases card data stored in system logs from before April 3 was also exposed. After the investigation the company said it was boosting its checkout security.
Sources checked: pymnts.com, thehackernews.com, insideretail.co.nz
Last verified against the official page:
What was exposed
The malware was built to capture card numbers, expiration dates and verification codes, and in some cases cardholder names. In most cases it found only the card's track data, which didn't include a name. Reports about this breach don't list Social Security numbers, addresses or passwords.
What that means for you
Stolen card details are mainly used for fraudulent purchases. Because names weren't usually included, the risk to your wider identity is lower than in a breach of personal records. The practical step is to check the cards you used in Forever 21 stores in 2017 and ask the issuer to replace any you're unsure about.
What to do if you were in it
- 1
Look back through 2017 statements
Check statements for the cards you used in Forever 21 stores between April and November 2017. Dispute charges you don't recognize with your card issuer.
- 2
Ask for a new card number if you're unsure
If you used a card in those stores and still have it, call the issuer and ask for a replacement. The FTC's data breach guidance says to contact the issuer when card numbers are exposed.
- 3
Turn on transaction alerts
Most banks can text or email you for each purchase or for charges over an amount you choose. That catches fraud within minutes instead of at the end of the month.
- 4
Treat messages that mention the breach with suspicion
Criminals send fake notices that use real breach details. Don't click links or call numbers in an unexpected email, text or letter. Go to the company's website yourself, or use a phone number you already trust.
- 5
Check whether your email or phone number shows up in this and other breaches
A free Serus scan checks your email and phone number against breach databases and tells you what to do about anything it finds. Serus can't remove data from a breach, but it alerts you when new exposures appear.
Official filings
- California Attorney General , filed 1 Jun 2018
- California Attorney General , filed 28 Dec 2017
Timeline
-
The breach happened
-
Reported to the California Attorney General
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Forever 21 breach?
Only customers who paid by card in U.S. Forever 21 stores during the affected window, at an affected device. Forever 21 said not every store or terminal was involved.
What was exposed in the Forever 21 breach?
Card numbers, expiration dates and verification codes, and in some cases cardholder names.
How many people were affected?
Forever 21 didn't publish a number.
Should I change my password?
The reports about this breach don't list passwords or account logins as exposed, so a password change isn't called for by the breach itself.
Sources
- pymnts.com/cybersecurity/2018/https-www-pymnts-com-news-2018-forever-21-malware-pos-hackers-payment-security/
- thehackernews.com/2018/01/credit-card-data-breach.html
- insideretail.co.nz/2018/01/04/forever-21-data-breach-prompts-checkout-security-boost/
- oag.ca.gov/privacy/databreach/list
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
