When: (First Reported): Reported Publicly by Equifax September 7, 2017

What: Equifax is one of the 3 major Credit Reporting Agencies. Equifax publicly reported a breach of their systems which was discovered on July 29, 2017. The breach led to the compromise of approximately 143 million consumers' personal data. Consumer data involved in the breach included credit cards numbers, Social Security Numbers, birth dates, addresses, Driver's License Numbers, and "certain dispute documents with personal identifying information."

Who this affects: There is the potential for personal data compromise for any U.S. consumer.

Macy's Action: We have assessed the situation and want you to know that the Equifax breach did not involve a breach of Macy's Inc. systems. We will continue to monitor developments. Consumers should be aware that the level of information compromised at Equifax could be used to cause financial harms or commit identity frauds at almost any business or at some government agencies. If we suspect suspicious account or online activity at macys.com, we take action to notify customers and often block accounts to prevent misuse by criminals. Unfortunately, no security or anti-fraud measures can be 100% effective. But our customers are never held responsible for fraudulent charges and we will work diligently with you to protect your personal data.

Recommended Customer Action:

• Visit Equifax's home page for the latest information on the breach at https://www.equifax.com/personal/ . Equifax also provides and an application to see if your data has been compromised.
• Remain vigilant for incidents of fraud and identity theft by reviewing bank and credit card account statements and monitoring your credit reports regularly. You may obtain a free copy of your credit report from each company listed below once every 12 months by requesting your report online at www.annualcreditreport.com , calling toll-free 1-877-322-8228, or mailing an Annual Credit Report Request Form (available at www.annualcreditreport.com ) to: Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA, 30348-5281. You may also purchase a copy of your credit report by contacting any of the credit reporting agencies below:

Equifax

P.O. Box 740241 Atlanta, GA 30374

www.equifax.com

1-888-766-0008 (TTY: 711)

Experian

P.O. Box 9554 Allen, TX 75013

www.experian.com

1-888-397-3742 (TTY: 711)

TransUnion

P.O. Box 2000 Chester, PA 19016

www.transunion.com

1-800-680-7289 (TTY: 711)

If you believe you are the victim of identity theft, you should contact the proper law enforcement authorities, including local law enforcement, and you should consider contacting your state's attorney general and/or the Federal Trade Commission ("FTC"). You may also contact the FTC to obtain additional information about avoiding identity theft.

Federal Trade Commission (FTC)

Consumer Response Center

600 Pennsylvania Avenue NW Washington, DC 20580

www.ftc.gov/idtheft

877-IDTHEFT (1-877-438-4338) (TTY: 711)

You may obtain information from the FTC and the credit reporting agencies listed above about placing a fraud alert and/or credit freeze on your credit reports.

When: (First Reported): July 20, 2016 & ongoing

What: Individuals reported receiving fake Macy’s branded emails with a subject line the same or similar to: “Macy’s Gift Card – Click Here .” Subject lines may contain different text than this example. The content of the email message states that the email recipient has been chosen to receive a special reward or can enter for a chance to win a gift card if that recipient clicks on a link to answer several questions about her shopping experience with Macy’s. These emails ARE NOT LEGITIMATE and Macy’s is not running a “Macy’s Shopper Survey.” The emails are generated from a fake email address (e.g. MacyVoucher@beigeindustries.com) that is not in use by Macy’s. These emails are “phishing” attempts designed to entice recipients to disclose personal information.

Who this affects: Any person with the ability to receive emails. Recipients of these phishing emails may not have ever shopped at Macy's or have any account with Macy's.

Macy's Action: Macy's is responding to individuals who have contacted us regarding this issue. We are working with our brand protection vendor to monitor and shut down this scam. We are also monitoring the volume and timing of customer calls to determine if the issue should be referred to law enforcement.

Recommended Customer Action:

• Do not click on or follow any links in the email.
• Do not interact with the sender of the email (for example, do not attempt to ‘reply’ to sender.
• If you have the ability, block these emails or report the emails as spam in your email client (for example, gmail or outlook).

Call our Customer Care team at 1-800-289-6229 (TTY: 711) with any questions.

Customers have reported receiving the following solicitations using the Macy's name. These are not from or endorsed by Macy's, and we recommend that you not respond:

• Postings on Craigslist alleging that the poster is casting for Glamorama. Frequently, these posters will subsequently ask customers for money to be considered for the Glamorama show.
• Recruitment emails regarding resumes received for a customer service position advertised on Craigslist. The sender of the email claims to be a Macy's representative offering a job as an Accounts Receivable Manager (A R M) for Macy's.
• Emails, banners or other ads promising a $500 Macy's gift card in exchange for taking a survey or trial offer. Some of these offers may appear as emails or wall postings on social networking sites and may look like they're coming from or being endorsed by your friends.
• Emails, letters or calls asking customers to pay money or provide account numbers to claim prizes.