Forever 21 reported a data breach affecting 539,207 people. Unauthorized access occurred from January 5 through March 21, 2023, and potentially exposed names, dates of birth, Social Security numbers, bank-account or other financial information, and employee health-plan data. Available public information indicates the affected population was current and former employees, not ordinary retail shoppers, although the public record does not categorically rule out every customer-related record.
What happened in the Forever 21 breach?
Forever 21 identified a cyberattack affecting some company systems on or around March 20, 2023, according to reporting on its notification letter. Its subsequent investigation determined that an unauthorized party had accessed systems beginning at least January 5, 2023, with access occurring several times through March 21, 2023. Files available during that period were later found to contain personal information.
As an Amazon Associate I earn from qualifying purchases.
The Maine Attorney General’s breach record lists August 4, 2023, as the discovery date for notification purposes. Forever 21 reported the incident to state authorities and sent written notices to affected people between August 29 and August 31, 2023. The Maine filing identifies 539,207 affected individuals, rather than merely “about 500,000.”
Free tools Windows power users keep installed
One-click scans. No signup required.
The public notices do not establish how the attackers initially entered the network, who they were, whether ransomware was deployed, or whether any ransom was paid. SecurityWeek noted that language in the notice could suggest communications with an unauthorized party, but a ransom remains unconfirmed.
#1 Best Overall
Sources: Maine Attorney General filing, SecurityWeek.
Who was affected: employees or customers?
The headline can make this sound like a breach of Forever 21’s shopper database. Available evidence points instead to current and former employees. A Forever 21 spokesperson told TechCrunch that the affected information belonged to current and former employees, and the notice referenced employee health-plan enrollment and premiums paid.
The data categories—full birth dates, Social Security numbers, bank-account information and benefits records—also fit human-resources and payroll files more closely than ordinary shopping accounts. The most accurate description is: more than 539,000 people were affected, and public information indicates they were primarily, or possibly exclusively, current and former employees rather than ordinary retail customers. No primary notice reviewed here categorically states that every Forever 21 shopper was excluded.
Source: TechCrunch.
What information may have been exposed?
The notices identify categories of information that may have been present in affected files. They do not establish that every person had every data element exposed.
- Names or other personal identifiers
- Full dates of birth
- Social Security numbers
- Bank-account or other financial information
- Forever 21 health-plan information
- Health-plan enrollment details and premiums paid
Maine and Washington records identify Social Security numbers and dates of birth among the potentially involved data. The employee health-plan details were reported in connection with employee records. This was not described as a payment-card breach, and it should not be confused with Forever 21’s separate 2017–2018 point-of-sale incident involving card information (see the California notice for that older incident).
Forever 21 breach timeline
| Date | What the public records say |
|---|---|
| January 5, 2023 | Earliest date the Maine filing says unauthorized access began. |
| March 20, 2023 | Forever 21 identified a cyberattack affecting some systems, according to coverage of the notification letter. |
| March 21, 2023 | End of the identified unauthorized-access period in the state records. |
| August 4, 2023 | Discovery date listed in the Maine Attorney General database. |
| August 29–31, 2023 | Written notifications were sent, according to the Maine filing. |
| August 31, 2023 | TechCrunch and SecurityWeek published reports about the breach. |
These milestones describe different stages: the intrusion period, initial attack identification, formal discovery for regulatory reporting, and consumer notification. They should not be collapsed into one discovery date.
How many people were affected in each state?
State filings provide subsets of the national total. They are not figures to add on top of 539,207.
Recommended Free Tools
| Jurisdiction | Residents reported | Source |
|---|---|---|
| Maine | 1,139 | Maine filing |
| Washington | 9,855 | Washington Attorney General |
| Delaware | 2,021 in the original notice, plus six in a supplemental notice | Delaware Attorney General database |
What did Forever 21 do?
- Investigated the unauthorized access and took steps intended to block further access.
- Reported the incident to state authorities.
- Sent written notices to affected individuals.
- Offered 12 months of Experian IdentityWorks to people covered by the notice.
Forever 21 also said it had no evidence at the time of notification that the information had been used for fraud or identity theft, and no indication that the unauthorized party had further copied, retained or shared it. That was a time-limited result of the company’s investigation—not proof that later misuse is impossible. The Maine filing does not establish that every affected person successfully enrolled in monitoring, and a 12-month offer may have expired for many recipients.
Rank #3
What affected people should do now
1. Verify the notice
Use the telephone number or mailing address printed in your individual letter. Do not provide a Social Security number, bank details or payment to an unsolicited caller claiming to arrange breach assistance. Avoid relying on links in unexpected emails; confirm through Forever 21 or the contact information in the mailed notice.
2. Check the monitoring offer
If your letter included an enrollment deadline, follow its instructions for the 12-month Experian IdentityWorks offer. Do not guess an activation code or assume a generic Experian subscription is the same benefit. The official vendor site is Experian.
3. Freeze your credit with all three bureaus
A credit freeze restricts access to your credit file for most new-credit applications. It is generally more protective against new-account fraud than monitoring alone, although it can add a step when you legitimately apply for credit. Place the freeze separately with:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A fraud alert is easier to maintain but is less restrictive and does not lock access to your files.
4. Review your credit reports
Obtain reports through the official federal source, AnnualCreditReport.com. Look for unfamiliar accounts, hard inquiries, addresses or employers. Monitoring can alert you to some credit-file activity, but it does not prevent every form of identity theft.
5. Check bank and payment accounts
Review withdrawals, transfers, new payees and changes to account details. If bank-account information may have been exposed, ask your financial institution whether an account-number change, transaction limits or additional verification is appropriate. Replacing an account can disrupt payroll deposits, automatic payments and recurring transfers, so update legitimate instructions before closing the old account.
6. Expect convincing phishing
Attackers can use employment history, benefits details or knowledge of the breach to impersonate Forever 21, Experian, a payroll provider or a health-plan administrator. Treat unexpected requests for passwords, one-time codes, Social Security numbers or payment as suspicious. Contact the organization through a known website or statement, not the message’s link or phone number.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches7. Report and document suspected identity theft
Report suspected identity theft and obtain recovery guidance at IdentityTheft.gov. Keep the breach notice, monitoring enrollment confirmation, credit reports, account correspondence and any police or identity-theft reports.
Best Value
What remains unknown?
- The initial access method and the attackers’ identity
- Whether ransomware was used
- Whether any ransom was demanded or paid
- Whether accessed information was later distributed
- Whether every affected record belonged to an employee, or whether another category was included
Those gaps are why the incident should not be labeled a ransomware attack, described as a confirmed customer-database breach, or declared completely resolved without additional evidence.
Frequently asked questions
Did the Forever 21 breach affect customers?
Public information indicates that the affected data belonged to current and former employees. It does not provide a categorical primary-source statement that no customer-related record was involved.
How many people were affected?
The Maine Attorney General filing reports 539,207 people. Maine, Washington and Delaware counts are state subsets of that total.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Was credit-card information involved?
The 2023 notices describe Social Security numbers, birth dates, financial information and employee health-plan data; they do not identify payment-card data. This incident is separate from Forever 21’s 2017–2018 payment-card incident.
Is the Experian offer still available?
It was a 12-month offer described in individual notices sent in August 2023. Eligibility and any deadline depend on the notice you received; do not assume a generic Experian plan provides the same benefit.
Should affected people freeze their credit?
Yes, a freeze is a free, generally stronger safeguard against many new-credit applications than monitoring alone. It must be placed separately with Equifax, Experian and TransUnion.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
