Cyber Incident Victim: Sferra Fine Linens
Date:
Apr 2022
Location:
United States of America
Summary
A cybersecurity incident at Sferra Fine Linens exposed sensitive personal information, including names, addresses, financial account details, Social Security numbers, medical data, and account credentials, with evidence suggesting the compromised data primarily pertained to employees. Unauthorized access to company servers persisted for approximately two weeks before detection, though the breach did not affect e-commerce platforms or related systems. The company has not disclosed the number of impacted individuals, and no ransomware groups have publicly claimed responsibility for the intrusion.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Sferra Fine Linens, a luxury textile company established in 1891, disclosed a cybersecurity incident on August 19, 2022, impacting personal information. The company detected unauthorized access to its servers on April 24, 2022, concluding that threat actors maintained access for approximately two weeks prior to discovery. Compromised data included names, addresses, birth dates, passport details, driver’s license information, Social Security numbers, financial account data, medical and health insurance records, electronic signatures, and account credentials. The nature of the exposed information strongly indicated that affected individuals were primarily employees rather than customers. Sferra did not disclose the exact number of impacted persons but emphasized that its e-commerce platforms and associated systems remained unaffected by the breach.
The company initiated individual notifications on the disclosure date but provided no public details regarding containment measures, forensic investigations, or whether law enforcement was engaged. SecurityWeek’s review of prominent ransomware group leak sites found no claims of responsibility associated with the incident, leaving the attacker’s identity and motives unconfirmed. The breach exposed highly sensitive categories of personal data, creating significant risks of identity theft and financial fraud for affected employees. Sferra’s four-month gap between detection (April 24) and public disclosure (August 19) was not explained in the announcement. No information was released regarding credit monitoring services, password resets, or other remediation offered to victims. The incident highlighted vulnerabilities in Sferra’s internal systems while sparing its customer-facing sales infrastructure.