Macy's confirmed it had suffered a "highly sophisticated and targeted data security incident related to macys.com that affected a small number of customers during a one-week period in October". The leaked information potentially includes customer first and last names, addresses, phone numbers, and payment card numbers, security codes and expiration dates, and didn't affect mobile transactions. "Our security teams quickly engaged a leading forensic firm to remove the threat," said Macy's in a statement. "Details of this incident were reported to federal law enforcement for investigation and to assist other websites in managing this threat. Affected customers have been notified and will receive additional information, including instructions on how to enroll in consumer protection services at no cost. Security and privacy remain our priority."

Macy's and Macy's-owned Bloomingdale's last year suffered a similar breach.