Nordstrom Email System Compromised in Crypto Phishing Scam

• •Hackers exploited Nordstrom's email system to send phishing scams.
• •Victims lost approximately $5,600 to the fraudulent cryptocurrency offers.
• •Nordstrom confirmed the breach involved Okta SSO and Salesforce compromise.

On March 17, 2026, Nordstrom's email system was exploited by hackers to send phishing emails to customers, disguised as a St. Patrick's Day promotion. The fraudulent emails, originating from a legitimate Nordstrom address, promised to double any cryptocurrency sent to a specified wallet address. Reports indicate that victims lost a total of $5,600 to the scam. The breach was traced back to a compromise involving Okta SSO and Salesforce, allowing unauthorized access to customer email communications. Nordstrom has since alerted its customers to disregard the scam and is investigating the incident. The company emphasized that it will never request cryptocurrency transactions from customers. The scope of the attack remains unclear, but it potentially affected a significant number of Nordstrom's 33 million active customers. As of now, Nordstrom is taking immediate action to address the security breach.