F500 Retail & Grocery · General Merchandisers · Structural / no discrete incident
Kohl's
Headline
A third-party debt-collector breach (FBCS, 2024) is the finding, and it illustrates the structural point: a retailer's exposure is a function of how many third parties it hands data to, not how well it defends its own…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
A third-party debt-collector breach (FBCS, 2024) is the finding, and it illustrates the structural point: a retailer's exposure is a function of how many third parties it hands data to, not how well it defends its own perimeter. Kohl's also operates a large private-label credit programme, which means the customer relationship includes a credit file - cross-ref the Synchrony row in Credit Card Companies for who actually holds a store card.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
THIRD-PARTY-VENDOR BREACH: Kohl's was named in class-action litigation (reported Oct. 2024) tied to the February 2024 breach at Financial Business and Consumer Solutions Inc. (FBCS), a DEBT-COLLECTION AGENCY whose breach affected more than 4.2 million people — illustrating how a company that HIRES a third-party debt collector can become entangled in that collector's OWN security failure. An earlier version of this row also described a separate 2024 vendor breach exposing 4+ million Kohl's customers; no source for a second, distinct breach was found and it appears to duplicate the FBCS incident.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (KSS). Service route: c/o General Counsel / Corporate Secretary, Menomonee Falls, Wisconsin — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy kohls.com/feature/privacy-policy.jsp | Not fetched yet | NO (HTML only) |
| Terms of service kohls.com/feature/terms-of-use.jsp | Not fetched yet | NO (HTML only) |
| Website kohls.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No comprehensive state privacy statute on file for Wisconsin