Data breach at clothing retailer Earthbound Holding affected over 6,700 individuals

Texas-based clothing and accessory retailer Earthbound Holding suffered a data breach in December that compromised the personal information of more than 6,700 customers, including their Social Security numbers.

 

The clothing retailer, founded in the 1990s and running 140 retail stores across the United States, announced in a data breach filing with the office of the Attorney General of Maine that it identified a data breach incident in December that involved third parties gaining unauthorised access to its computer network.

 

The company, headquartered in Grapevine, Texas, and doing business as Earthbound Trading Company, did not state when the actual intrusion took place but discovered the malicious activity on December 18 and immediately secured its network and initiated an investigation to determine what data was affected and the nature and scope of the cyber attack.

 

The company said in its filing that it completed its investigation on March 6 with help from external cyber security experts and determined that the cyber security incident compromised the names and Social Security numbers of about 6,766 individuals. 

 

Earth bound sells a variety of clothes and accessories across 140 locations in the United States, including dresses, tops, jewellery, bags, hats and other accessories. The company did not state whether the security incident affected the personal information of its employees as well.

 

The company said it has reported the incident to the FBI and has implemented additional measures to secure its network and prevent such an incident from occurring again.

 

The clothing retailer is now offering 12 months of free credit monitoring and identity theft protection services to all affected individuals, including a $1,000,000 identity theft insurance policy. 

 

The data security incident affecting thousands of Earthbound customers has drawn the attention of several law firms in the U.S. that pursue class action litigation on behalf of affected individuals against businesses that suffer large-scale data breaches as a result of weak or inadequate security controls around customer data.