During the incident, which occurred in May 2020, hackers were able to exfiltrate information associated with online customer accounts, including payment card data, the company says.

A total of 4.6 million online customers were affected by the attack and Neiman Marcus is working on notifying them. The company also says that 3.1 million payment and virtual gift cards were compromised, 85% of which were either expired or invalid.

Personal information stolen in the attack includes names and contact information, usernames, passwords, as well as answers to security questions associated with the online accounts.