Five Below Reports Cybersecurity Incident After Employee Computer Compromise

What Happened
Five Below, Inc. filed an 8-K (Item 8.01) reporting that it detected anomalous activity on a company-issued computer on July 15, 2026. The company says a threat actor used social engineering on July 14, 2026 to gain unauthorized access to that employee’s machine and exfiltrated a number of files. Five Below promptly activated its incident response plan, engaged third-party cybersecurity experts, initiated a forensic investigation, and took steps to contain and terminate the access.

Key Details

• Detection and response: anomalous activity detected July 15, 2026; unauthorized access occurred July 14, 2026.
• Scope: Company believes the incident was limited to the affected employee’s environment and did not affect other systems, platforms, data, or environments.
• Data: As of filing, Five Below states no personally identifiable information (PII) was accessed or exfiltrated.
• Impact: The company does not believe the incident has had, or is reasonably likely to have, a material impact on its business, operations, financial condition, or results of operations; it included standard forward‑looking caution about possible further risks.

Why It Matters
This informs investors that Five Below experienced a targeted cybersecurity incident but reports it was contained quickly, limited in scope, and—per the company—did not involve PII or other systems. The company’s position that the incident is not expected to be material reduces immediate financial concerns, but investors should note the filing’s caution that investigations, regulatory reviews, or future findings could change that assessment.