Caleres, Inc. data breach

What we know

Caleres, Inc. is a major footwear retailer and brand portfolio owner that operates numerous well-known shoe brands and retail chains across the United States. As an enterprise managing vast direct-to-consumer e-commerce platforms, extensive supply chains, and millions of customer accounts, the company routinely collects and processes substantial volumes of personally identifiable information. This includes sensitive customer records, payment card data, online account credentials, and shipping addresses necessary to facilitate retail transactions, loyalty program memberships, and digital orders across its sprawling retail footprint. In 2026, Caleres, Inc. reported a significant data security incident to the New Hampshire Attorney General, alerting consumers to an unauthorized compromise of its digital environment. While the exact vector of the attack continues to be evaluated, retail data breaches of this magnitude typically involve sophisticated cyberattacks such as credential stuffing, malware deployment, or unauthorized intrusions into centralized customer databases and third-party vendor platforms. Retailers are prime targets for malicious actors seeking to exploit vulnerabilities in e-commerce infrastructure to siphon valuable consumer data. The breach compromised a variety of sensitive consumer information, each category carrying distinct and severe risks for affected individuals. Exposed data frequently includes full names, email addresses, mailing addresses, hashed passwords, and detailed purchase and order histories, alongside potentially sensitive payment card details. When cybercriminals obtain this combination of personal and financial information, victims face heightened risks of targeted phishing scams, unauthorized account takeovers across multiple platforms, fraudulent credit card charges, and synthetic identity theft that can take months or years to resolve. As a commercial enterprise handling consumer data, Caleres, Inc. was bound by stringent legal duties under state consumer protection statutes, the Federal Trade Commission Act, and industry standards such as the Payment Card Industry Data Security Standard (PCI-DSS). These frameworks mandate the implementation of robust administrative, technical, and physical safeguards—including continuous network monitoring, data encryption, and regular vulnerability assessments—to protect consumer data against unauthorized access. The occurrence of a breach strongly suggests potential failures in upholding these foundational security obligations, leaving consumer data vulnerable to exploitation. For consumers who received a data breach notification letter from Caleres, Inc., this document serves as official confirmation that your confidential information was compromised due to corporate security failures. Legally, the receipt of this notice establishes standing to participate in class action litigation aimed at holding the company accountable for negligence and inadequate data protection practices. Affected individuals should know that they do not need to show proof of direct financial loss to join a class action, and our firm handles these cases on a contingency fee basis, meaning you pay nothing out of pocket unless we successfully recover compensation on your behalf.

See every breach reported in New Hampshire or read what to do after a ransomware attack.