Cardi's Department Store Reports 2025 Data Breach in Maryland

Cardi's Department Store Inc., a regional retailer with both brick-and-mortar stores and an e-commerce platform, routinely collects and stores extensive customer data. This includes customer account profiles, shipping addresses, telephone numbers, and payment card details necessary for transactions, as well as loyalty program information.

On March 10, 2025, Cardi's Department Store Inc. officially reported a cybersecurity incident to the Maryland Attorney General. The filing indicates an unauthorized external actor gained access to its corporate networks, potentially through methods like unauthorized access to e-commerce portals, malware, or credential-stuffing campaigns. This exposure suggests a failure to secure consumer data, raising questions about the company's security measures.

The breach exposed several categories of sensitive personal data. These include individuals' Full Name, Email Address, Mailing Address, Phone Number, Payment Card Information, Purchase and Order History, and Password or Credential Hash. The combination of these data types creates significant risks for affected individuals.

Exposure of Payment Card Information can lead to unauthorized charges, while compromised Full Name, Email Address, Mailing Address, and Purchase History can be used by malicious actors for sophisticated phishing schemes or identity fraud. Individuals who receive a breach notification should take immediate steps to protect themselves by monitoring financial accounts and considering changes to online credentials.

To mitigate potential harm, affected individuals should promptly review all bank and credit card statements for any suspicious activity and report unauthorized transactions immediately. It is also advisable to change passwords for all online accounts, especially those using the same credentials as their Cardi's Department Store account. Additionally, consider placing a fraud alert or security freeze on credit reports with major credit bureaus, and remain vigilant against unexpected communications or unusual account requests.