Five Below Reports Social-Engineering Breach of Employee Computer

Summary

Five Below says a threat actor used social engineering on July 14, 2026, to access one employee’s company-issued computer and exfiltrate files. The company believes the incident was contained to that device, with no access to other systems or PII.

Key points

• Five Below reported that a threat actor used social engineering to gain unauthorized access to a single employee’s company-issued computer on July 14, 2026.
• Files were exfiltrated from the device; the filing does not specify their contents.
• The company says it activated its incident response plan and engaged third-party cybersecurity experts.
• Five Below believes the incident was contained to the employee’s computer, with no access to personally identifiable information or other systems, platforms, data, or environments.
• Based on current information, the company does not believe the incident has had or is reasonably likely to have a material business or financial impact.
• The company says additional affected systems or data could be identified, and warns that exfiltrated information could be misused or lead to regulatory action or litigation.