Hibbett Retail says data breach exposed employee personal data

American sporting-goods retailer Hibbett Retail said a data security breach earlier this year compromised the sensitive personal data of its current and former employees.

 

Headquartered in Birmingham, Alabama, Hibbett is a U.S. sporting-goods retailer offering footwear, apparel, and accessories from brands like Nike, Jordan, Adidas, New Balance, and HOKA. It operates over 1,100 Hibbett and City Gear stores nationwide, along with an online store and mobile app.

 

In a data security notice submitted to the office of California Attorney General, Hibbett disclosed that it detected an unauthorised intrusion into its network. The company promptly initiated an investigation, supported by external cyber security specialists, to assess the nature and extent of the breach.

 

It also took steps to secure the affected systems, contained the disruption and notified relevant law enforcement authorities about the incident.

 

The investigation determined that threat actors breached its internal network between April 22 and April 25 and stole confidential information including “personnel records that we maintain for HR purposes related to current and former employees and their dependents, and/or beneficiaries.” 

 

The compromised data included names, and other personal identifiers including Social Security numbers. While Hibbett has not yet determined the total number of individuals affected, the company told Texas regulators that the breach impacted approximately 15,223 people in the state. Hibbett also reported the incident to regulators in Vermont, Washington, and other states.

 

While Hibbett found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

It has also offered complimentary identity protection and credit monitoring services through Experian IdentityWorks to all affected individuals.

 

No known threat actor claimed responsibility for the cyber attack at the time of publication. Hibbett also did not share details regarding the perpetrators, the exact volume of exfiltrated data, and whether a ransom demand was made.