Macy’s Customer Data Exposed After October Website Hack -- Security Today

Macy’s Customer Data Exposed After October Website Hack

The department store chain is notifying customers that hackers were able to scrape credit card data from online purchases for about a week.

By Haley Samsel
Nov 21, 2019

Ahead of the holiday shopping season, Macy’s is not feeling the Christmas cheer. That’s because the department store’s website was the target of a cyber attack in October, according to a letter that Macy’s sent to affected customers.

On Oct. 15, Macy’s security teams were alerted to a connection between macys.com and another website. After investigating, the company realized that an unauthorized third party added unauthorized computer code to two pages on macys.com a week earlier on Oct. 7.

The code allowed the third party to capture information submitted by customers either through the checkout page and or the “wallet page,” where customers store their credit card information on their Macy’s accounts.

While the code was promptly removed on Oct. 15, hackers were still able to gather the names, addresses, phone numbers, email addresses and payment card numbers of customers who typed that information into the checkout page or the “My Account” wallet page.

Macy’s has not said how many customers were affected, and the chain has taken the case to federal law enforcement. After the incident was announced on Tuesday, Macy’s shares fell by nearly 11 percent, CBS News reported.

In a letter to affected customers, the company said that it is offering identity protection services for 12 months free of charge and has taken steps to keep future cyber attacks at bay.

“We have taken steps that we believe are designed to prevent this type of unauthorized code from being added to macys.com,” the letter reads.

This is the second security breach that Macy’s has suffered in the past two years. In the spring of 2018, hackers were able to gain access to customers’ usernames and passwords through both macys.com and bloomingdales.com for over a month. Back then, the company said it had also implemented new security measures to protect customer data.

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

Survey: Nearly Half of Employees Hide Workplace AI Use

Laserfiche, a SaaS provider of intelligent content management and business process automation, recently released new survey findings on AI adoption in the workplace, revealing that nearly half of Americans (49%) who use AI at work keep it to themselves, with 15% deliberately avoiding telling their manager. Read Now
- Artificial Intelligence
- Cybersecurity
46% of Enterprise Passwords Are Vulnerable to Cracking

Picus Security recently released The Blue Report™ 2025, based on more than 160 million real-world attack simulations. Now in its third year, the report provides a data-driven assessment of how well security controls perform against today’s threats — and this year’s findings are the most concerning to date. Read Now
- Cybersecurity
Community-Led Video Security Network Transforms Pennsylvania City Public Safety

A community-supported video security initiative has transformed public safety in Lancaster, Pennsylvania. The citizen-led collaboration demonstrates how open platform video technology can help revitalize struggling urban areas. Read Now
- Government
Browser-Based AI Agents: The Silent Security Threat Unfolding

Some of the most revolutionary advances in artificial intelligence include browser-based AI agents, which are self-sustaining software tools integrated into web browsers that act on behalf of individuals. Read Now
- Cybersecurity
Report: Cybercriminals Abandon Tech Tricks for Personalized Email Deception Tactics

VIPRE Security Group, a cybersecurity, privacy, and data protection company, has released its email threat landscape report for Q2 2025. Through an examination of worldwide real-world data, this report sounds the alarm on the most significant email security trends observed in the second quarter of 2025, enabling organizations to develop effective email security defenses for the remainder of the year. Read Now
- Cybersecurity

Security Today eNews

Sign up today for essential industry news and product information that can help you stay afloat in the fast-paced world of security.

Email Address*Country*

Please type the letters/numbers you see above.

PureTech Systems, Clear Align Partner to Deliver Advanced Autonomous Security, Command-and-Control for U.S. Air Force Tactical Security System

Webinars

Whitepapers

New Products

Mobile Safe Shield

SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.
ResponderLink

Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.
Connect ONE®

Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.