Forever 21

In 2018, Forever 21 experienced a significant cybersecurity breach that lasted seven months. During this period, attackers accessed and likely stole payment card data through malware planted on the retailer's point-of-sale (POS) systems. Some of these systems weren't encrypted properly, exacerbating the vulnerability. The exact number of affected customers remains undisclosed, but the incident led to a class-action lawsuit. Forever 21 settled by agreeing to compensate for valid out-of-pocket expenses incurred as a result of the breach, though the total settlement cost was not revealed.

Source: https://arcticwolf.com/resources/blog/10-major-retail-industry-cyber-attacks/

TPRM report: https://scoringcyber.rankiteo.com/company/forever-21

"id": "for302050724",
"linkid": "forever-21",
"type": "Breach",
"date": "07/2023",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'Retail',
                        'name': 'Forever 21',
                        'type': 'Retailer'}],
 'attack_vector': 'Malware on POS systems',
 'data_breach': {'data_encryption': 'Improper',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Payment card data'},
 'description': 'In 2018, Forever 21 experienced a significant cybersecurity '
                'breach that lasted seven months. During this period, '
                'attackers accessed and likely stole payment card data through '
                "malware planted on the retailer's point-of-sale (POS) "
                "systems. Some of these systems weren't encrypted properly, "
                'exacerbating the vulnerability. The exact number of affected '
                'customers remains undisclosed, but the incident led to a '
                'class-action lawsuit. Forever 21 settled by agreeing to '
                'compensate for valid out-of-pocket expenses incurred as a '
                'result of the breach, though the total settlement cost was '
                'not revealed.',
 'impact': {'data_compromised': 'Payment card data',
            'legal_liabilities': 'Class-action lawsuit',
            'payment_information_risk': 'High',
            'systems_affected': 'POS systems'},
 'motivation': 'Financial Gain',
 'post_incident_analysis': {'root_causes': 'Improper encryption on POS '
                                           'systems'},
 'regulatory_compliance': {'legal_actions': 'Class-action lawsuit'},
 'title': 'Forever 21 Data Breach',
 'type': 'Data Breach',
 'vulnerability_exploited': 'Improper encryption on POS systems'}