By John Kell
Sally Beauty Holdings Inc. said a continuing data breach
investigation showed more credit-card records may have been stolen
than the beauty-supplies company previously estimated.
After first disclosing an attempted data breach in the beginning
of March, Sally Beauty nearly two weeks later said credit-card data
from fewer than 25,000 customer records were illegally accessed and
may have been stolen.
But on Friday, Sally Beauty, which hasn't yet fully determined
the scope of the data breach, suggested the breach may have been
worse.
"As a result of the continuing investigation, we now understand
that a larger number of additional records containing payment card
data may have been illegally accessed and removed from our
systems," Sally Beauty said.
The company, which operates more than 2,700 Sally Beauty Supply
stores in the U.S., has worked with the U.S. Secret Service and
Verizon Communications Inc. to investigate the breach. Verizon's
cybersecurity unit is looking into several data breaches at
retailers, including one involving 40 million credit and debit card
accounts at Target Corp.
Write to John Kell at john.kell@wsj.com