The Charlotte Observer reports:
Two lawsuits were filed this week in federal court against Belk for a data breach and then for allegedly concealing the cyberattack. In both cases, the plaintiffs are also seeking certification for class-action suits.
Belk failed to protect sensitive personal current and former employee and customer information, according to the lawsuits, and has yet to provide information or details about the data breach that occurred sometime between May 7 and May 11.
Read more at The Charlotte Observer (paywalled).
Belk’s notification to the New Hampshire Attorney General stated:
Specifically, Belk was the victim of a cyber incident in which an unauthorized third party
gained access to certain corporate systems and data between May 7-11, 2025. After discovering
the incident on May 8, 2025, Belk worked diligently with third-party cybersecurity experts to
determine the source and scope of this unauthorized access. Belk concluded that the third party
obtained certain internal documents related to Belk.
Belk’s notification letters to those affected, dated June 5 , inform those affected what data elements of theirs were involved in the breach. Those affected were also offered complimentary services:
As a precaution, we have arranged for you, at your option, to enroll in a complimentary 12-month credit monitoring service. During this period, Belk will pay for Epiq Privacy Solutions ID, which includes, among other things, credit monitoring, dark web monitoring, identity restoration, and up to $1 million identity theft insurance. You have until <>, to activate the free credit monitoring service by using the following activation code: <>. This code is unique for your use and should not be shared. To enroll, follow the attached instructions.
Belk discovered an attack one day after it started, and although it took a few days for them to stop it, they notified everyone within a month and offered them complimentary mitigation services.
