2021 Unauthorized account access — 4.6M (May 2020 breach)
Data compromised
Usernames, passwords, security Q&A, names, contact info, payment card numbers, gift card numbers
Technical writeup
Unauthorized party obtained credentials and accessed online accounts. Discovered September 2021. Usernames, passwords, security Q&A, names, contact info, payment card numbers (no CVV), gift card numbers. 3.1M payment/gift cards affected; 85%+ expired. Mandiant forensic investigation.
Root cause
Unauthorized account access; credential compromise.