Breach at Neiman Marcus Went Undetected From July to December
The computer network at Neiman Marcus was penetrated by hackers as far back as July, and the breach was not fully contained until Sunday, according to people briefed on the investigation. — The company disclosed the data theft …
Context & Ripple Effects
The disclosure arc started on January 11, when Krebs on Security first reported hackers stealing customer card data at Neiman Marcus, and widened a day later when Reuters reported that other well-known U.S. retailers had also been breached over the holiday shopping season more well-known U.S. retailers hit. What the New York Times adds today is the timeline: the intrusion reached back to July and was not fully contained until this past Sunday — months of undetected access rather than a short burst.
The story has traveled unusually widely for a corporate security incident — pickups at the Wall Street Journal, Washington Post, Associated Press, Los Angeles Times, Reuters and The Verge all ran it on or about January 17 — which reflects how much it rides on the still-open question of whether the holiday-season retail breaches extend beyond Target.
First-order effects
- Customers whose credit and debit cards were exposed face fraud risk now, and Neiman Marcus must identify affected cards and work with issuers while an investigation with an unknown victim count continues.
- Neiman Marcus's brand takes the immediate hit: the six-month detection gap means the company must defend why its monitoring missed intrusions running through its busiest selling season.
Second-order effects
- Other retailers named in the Reuters reporting face pressure to disclose their own incidents quickly rather than let the timeline emerge piecemeal through investigators and press briefings, as happened here.
- Card issuers and payment networks absorb the cost side — reissuing compromised cards and absorbing fraud losses — sharpening the argument over who pays when retailer point-of-sale systems are breached.
Third-order effects
- If the pattern holds — long-dwelling intrusions surfacing only through investigator briefings rather than internal detection — retailers will face mounting scrutiny of point-of-sale security spending and mandatory-breach-notification rules, with disclosure timelines becoming the battleground between companies and regulators.
The trend: The 2013–14 holiday-season point-of-sale breaches are pushing large U.S. retailers from quiet remediation toward externally forced disclosure, with detection failure itself becoming the reputational story.