Dick's Sporting Goods discloses intrusion and locks employees out of email

Dick's Sporting Goods disclosed in a filing with the US Securities and Exchange Commission that on 21 August 2024 it discovered unauthorised third-party access to its information systems, including portions of those systems containing certain confidential information. The Form 8-K became public on 28 August 2024.

The retailer said it activated its cyber security response plan immediately on detecting the incident, engaged external cyber security experts to investigate, isolate and contain the threat, and notified federal law enforcement. It said it had no knowledge that the incident had disrupted business operations and did not believe it was material to its results, while noting it would reassess that conclusion if the investigation changed the picture.

Press reports of the response described more disruptive containment measures than the filing set out. According to those accounts the company shut down its email systems, locked employee accounts, and had IT staff verify employee identities over video before restoring access. Phone lines at a number of stores were also said to have been affected.

Dick's did not identify what categories of data were involved, how the attackers gained access, or whether an extortion demand followed. SecurityWeek reported that it had not seen any known ransomware group claim responsibility. The Register noted that the absence of operational disruption pointed to data theft rather than file encryption, since many ransomware crews now steal data and threaten to publish it rather than lock systems.