Neiman Marcus Pays $1.5M For 2013 Data Breach
BALTIMORE, MD —Maryland, the District of Columbia and 40 other states have settled with luxury retailer Neiman Marcus for a 2013 data breach that exposed payment cards for thounds of customers. The chain must pay $1.5 million and adopt measures to prevent hacks.
Maryland Attorney General Brian E. Frosh said in a news release that under the terms of the settlement, Neiman Marcus must pay to resolve the multistate investigation into the breach of customer payment card data at 77 stores. The breach took place over the course of several months and compromised the names and payment card data collected at Neiman Marcus retail stores across the country. Investigators say about 370,000 payment cards were compromised, including 8,323 associated with Maryland consumers. At least 9,200 of the payment cards compromised in the breach were used fraudulently.
“Businesses that collect and hold consumers’ payment card data have a responsibility to make sure that data is protected from hackers,” Frosh said in a statement. “This settlement requires Neiman Marcus to bolster its protection of consumers’ information to prevent a breach like this from reoccurring.”
Along with the $1.5 million settlement, Neiman Marcus must try to prevent breaches by:
Complying with Payment Card Industry Data Security Standard requirements
Maintaining a system to log and monitor its network activity
Maintaining agreements with payment card industry forensicinvestigators, operating separately, to allow for speedy investigation and remediation of any concerns
Updating software used to maintain and safeguard personal information;
Implementing industry-accepted payment security technologies
Using technologies like encryption and tokenization to obscure payment card data.
The settlement also requires Neiman Marcus to obtain an information security assessment and report from a third-party, and detail any steps the company may have taken or plans to take as a result of the report.
How to Protect Yourself from Identity Theft
Review your credit report from each of the three credit reporting agencies twice per year. You can stagger them so you are looking at a fresh report every two months. Under Maryland and federal law, you are entitled to two FREE credit reports from each of the Credit Reporting Agencies each year. Go to www.annualcreditreport.comor call 1-877-322-8228 to access your report through the federal Fair Credit Reporting Act. You must contact each of the three Credit Reporting Agencies individually to access your credit report under Maryland law: Equifax: 1-800-685-1111; Experian: 1-888-397-3742; TransUnion: 1-800-680-7289 .
Consumer Credit "Security Freezes"
A "security freeze" or "credit freeze" completely blocks the information on your credit report from would-be creditors. A credit freeze can help prevent identity theft. Most businesses will not open credit accounts without first checking a consumer's credit history. If your credit files are frozen, even someone who has your name and Social Security number might not be able to get credit in your name. Maryland law prohibits credit reporting agencies from charging more than $5 per credit freeze. Anyone who is a victim of identity theft will be able to freeze his or her credit reports for free.
For more information, check out the guide on freezing your credit report.
Information on how to protect your identity, or what to do in the event of a data breach can be found in the Maryland Office of Attorney General's Identity Theft Guide. Consumers who believe they may be a victim of identity theft should contact the Attorney General's Identity Theft Unit by calling (410) 576-6491 or by sending an email to idtheft@oag.state.md.us.
(For more news like this, find your local Patch here. If you have an iPhone, click here to get the free Patch iPhone app; download the free Patch Android app here. And like Patch on Facebook!)
Image via Shutterstock
