What the Macy’s Data Breach Means for Consumers and How Morgan & Morgan Can Help

On November 21, 2025, cybersecurity researchers reported that Macy’s, one of the largest and most recognizable retail brands in the United States, may have been compromised in a large-scale extortion and data-exfiltration campaign.

The threat actor responsible, the ransomware/ extortion group known as Cl0p, publicly added Macy’s to its leak-portal, indicating that internal systems had been accessed and sensitive data may have been stolen.

For consumers who do business with Macy’s and for employees, vendors, or others connected to the company, personal, sensitive information may have been acquired, putting consumers at risk for financial fraud and other threats. 

For Morgan & Morgan’s personal-injury and consumer-protection practices, we take these kinds of data breaches seriously. Our data breach attorneys understand the legal, regulatory, and practical risks that can follow a major corporate data breach. 

If you believe your information has been compromised, contact Morgan & Morgan today for a free case evaluation to learn more about your legal options.

What Happened With the Macy’s Data Breach?

Macy’s appeared on the Cl0p leak portal as part of a coordinated campaign targeting entities running the enterprise-resource-planning system Oracle E‑Business Suite (EBS). 

The attackers exploited vulnerabilities in Oracle EBS environments to gain unauthorized access, then listed victims with the threat of data publication unless contact was made.

While Macy’s has not (at the time of writing) publicly confirmed exactly what data was accessed or the full scope of the incident, the listing by Cl0p strongly suggests that internal corporate systems and customer-oriented data may have been compromised.

What Information Could Have Been Exposed by the Macy’s Data Breach?

Based on the nature of the attack and the typical data found in affected EBS systems, the following categories of data may have been materially exposed:

• Customer records, including contact information and transaction histories
• Point of sale environment documentation and operational logs
• Supply chain, inventory, and vendor management files
• Employee information, payroll data, and HR documents
• Corporate financial records and reporting files
• Internal communications and confidential business documents
• System configuration information used for administrative access

If any of these data classes were accessed, the potential consequences are significant, both for individuals whose personal data was exposed and for Macy’s (and its stakeholders) in terms of reputational, regulatory, and operational liability.

What Are the Risks?

The Macy’s data breach can mean different risks for different people.

For customers and consumers, if your personal information (name, address, email, purchase history) was among the exposed data, you face an elevated risk of identity theft, phishing attacks (including ones that impersonate Macy’s), account takeover attempts, and fraudulent transactions.

If payment or credit-card information was affected (less certain, but possible), then monitoring of accounts and being alert for unauthorized charges becomes a must.

For employees, vendors, and other stakeholders, if HR or payroll data were exposed, there may be a risk of fraud or impersonation using personal data.

If vendor or supplier data were compromised, you may face indirect exposure through downstream supply-chain attacks.

In terms of corporate and operational risks, because the incident is linked to a broad campaign targeting Oracle EBS systems, the breach may reflect systemic weaknesses, meaning the risk isn’t limited to Macy’s but may affect other connected organizations.

Macy’s may be required to notify affected individuals, regulators, and possibly face enforcement under state privacy laws or payment‐card network rules.

There is also potential for class-action or individual lawsuits by those harmed, or vendor claims by downstream partners.

 

What Should You Do If You Think You May Be Affected

If you are a customer, employee, or vendor connected to Macy’s, Morgan & Morgan recommends the following steps:

1. Be alert for phishing or spoofed communications referencing the breach or claiming to be from Macy’s. Do not click links in unexpected emails without verifying the sender.
2. Monitor your bank, credit-card, and account statements for unauthorized charges or suspicious activity.
3. Consider enrolling in a credit-monitoring or identity-protection service, especially if you believe sensitive personal data may have been exposed.
4. Reset passwords for any Macy’s accounts or accounts that used the same credentials and ensure multi-factor authentication (MFA) is enabled where possible.
5. If you believe you have suffered financial or personal injury (identity theft, fraud losses, emotional distress), contact Morgan & Morgan for a free case evaluation to determine whether you have a claim for damages or other legal remedies.
   
    

How Morgan & Morgan Can Help

If you believe you may have been harmed by a data breach, whether involving Macy’s or another large enterprise, our team at Morgan & Morgan is ready to assist. 

Our data breach lawyers can advise you on your legal rights and possible claims (for financial losses, identity theft, emotional distress, or other injury) and help you understand the notice-and-disclosure obligations of the company involved, and whether those were properly followed.

As the nation’s largest personal injury law firm with over 1,000 attorneys nationwide and over $25 billion recovered for our clients, we have the size, experience, and expertise to take on even the biggest corporations and win.

It starts with a free case evaluation, and if we can work together and pursue a claim, our team will guide you through credit-monitoring, identity-protection services, and documentation of loss for any legal action, while advocating for your interests in class-action participation or individual claims, if warranted.

If you shop at Macy’s, work for them, or partner with them, it’s wise to stay vigilant, and if you believe you may have been harmed, seek legal counsel without delay.

Morgan & Morgan is here to help you understand your rights, evaluate your options, and pursue the compensation you may deserve. Contact us today for a free confidential case evaluation.