Five Below discloses contained cybersecurity breach via social engineering

Filed July 22, 2026 · Period ending July 14, 2026 · ~1 min read

Key Changes

• medium

  Threat actor gained unauthorized access to one employee's computer on July 14, 2026, through social engineering and exfiltrated files from that device.

  Item 8.01 verify on EDGAR →
• medium

  Company states the incident was contained to the single employee's environment with no personally identifiable information compromised and no impact to other systems or data.

  Item 8.01 verify on EDGAR →
• low

  Five Below does not expect the incident to materially affect business strategy, operations, financial condition, or results of operations.

  Item 8.01 verify on EDGAR →