Five Below (NASDAQ: FIVE) reports isolated employee cyber breach

Rhea-AI Filing Summary

Five Below, Inc. reports a cybersecurity incident involving a single employee’s company-issued computer. On July 14, 2026, a threat actor used social engineering to gain unauthorized access and exfiltrated files from that device.

The company states it quickly activated its cybersecurity incident response plan, engaged third-party cybersecurity experts, and believes the incident was contained to that computer, with no access to personally identifiable information or other systems, platforms, data, or environments. Based on current information, it does not believe the incident has had, or is reasonably likely to have, a material impact on its business strategy, operations, financial condition, or results of operations.

Filing Explained

The filing qualifies Five Below’s current no-material-impact assessment: additional affected systems or data could be identified, exfiltrated information could be used harmfully, regulators could reach different conclusions, or litigation could result.

8-K Event Classification

Item 8.01 — Other Events

1 item

Item 8.01 Other Events Other

Voluntary disclosure of events the company deems important to shareholders but not covered by other items.

Key Figures

Unauthorized access date: July 14, 2026 Anomalous activity identified: July 15, 2026 Report signing date: July 22, 2026

3 metrics

Unauthorized access date July 14, 2026 Date a threat actor gained unauthorized access to an employee computer

Anomalous activity identified July 15, 2026 Date the company identified anomalous activity on the affected computer

Report signing date July 22, 2026 Date the report regarding the cybersecurity incident was signed

Key Terms

social engineering techniques, cybersecurity incident response plan, exfiltrated, forward-looking statements, +1 more

5 terms

social engineering techniques technical

"a threat actor used social engineering techniques that enabled unauthorized access"

cybersecurity incident response plan technical

"the Company promptly activated its cybersecurity incident response plan"

exfiltrated technical

"The threat actor exfiltrated a number of files from the affected computer"

forward-looking statements regulatory

"Certain statements contained in this on constitute forward-looking statements"

Forward-looking statements are predictions or plans that companies share about what they expect to happen in the future, like estimating sales or profits. They matter because they help investors understand a company's outlook, but since they are based on guesses and assumptions, they can sometimes be wrong.

material impact financial

"does not believe the incident has had, or is reasonably likely to have, a material impact"

Material impact refers to a significant effect that can influence the overall value, decision-making, or outlook of a business or investment. It matters to investors because such an impact can change the expected success or risk level of an investment, similar to how a major change in a recipe can alter the final taste—it's important enough to influence overall judgment or actions.

AI-generated analysis. How Rhea-AI works. Not financial advice.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

Understanding 8-K Material Events →

Available on EDGAR 07/22/2026 - 05:20 PM Accepted by SEC EDGAR 07/22/2026 - 05:19 PM Learn about SEC filing dates

FAQ

What cybersecurity incident did Five Below (FIVE) report on July 22, 2026?

Five Below reported that on July 14, 2026 a threat actor used social engineering to gain unauthorized access to one employee’s company-issued computer and exfiltrated files from that device. The incident was later detected and investigated with third-party cybersecurity experts.

Which systems and data were affected in Five Below’s (FIVE) cyber incident?

The company believes the incident was limited to a single employee’s computer. It states that no personally identifiable information was accessed or exfiltrated and that its other systems, platforms, data, and environments were not affected by the unauthorized access.

Did the cybersecurity incident have a material impact on Five Below’s (FIVE) business or finances?

Based on information available, Five Below states it does not believe the incident has had, or is reasonably likely to have, a material impact on its business strategy, operations, financial condition, or results of operations.

How did Five Below (FIVE) respond to the July 2026 cyber incident?

After identifying anomalous activity on July 15, 2026, Five Below promptly activated its cybersecurity incident response plan, initiated a forensic investigation with third-party experts, and took immediate steps it believes successfully contained and terminated the unauthorized access.

What ongoing risks or uncertainties does Five Below (FIVE) highlight from the cyber incident?

The company notes risks that additional affected systems or data could be identified, that exfiltrated information could be used harmfully, that regulators may disagree with its assessments, or that litigation could result, as outlined in its forward-looking statements.

FIVE BELOW, INC false 0001177609 0001177609 2026-07-14 2026-07-14

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, DC 20549

FORM 8-K

CURRENT REPORT

Pursuant to Section 13 or 15(d)

of the Securities Exchange Act of 1934

Date of Report (Date of Earliest Event Reported): July 14, 2026

FIVE BELOW, INC.

(Exact Name of Registrant as Specified in Charter)

Pennsylvania		001-35600		75-3000378
(State or Other Jurisdiction of Incorporation)		(Commission File Number)		(IRS Employer Identification No.)

701 Market Street

Suite 300

Philadelphia, PA 19106

(Address of Principal Executive Offices) (Zip Code)

Registrant’s telephone number, including area code: (215) 546-7909

Not applicable

(Former Name or Former Address, if Changed Since Last Report)

Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions:

☐ Written communications pursuant to Rule 425 under the Securities Act (17 CFR 230.425)

☐ Soliciting material pursuant to Rule 14a-12 under the Exchange Act (17 CFR 240.14a-12)

☐ Pre-commencement communications pursuant to Rule 14d-2(b) under the Exchange Act (17 CFR 240.14d-2(b))

☐ Pre-commencement communications pursuant to Rule 13e-4(c) under the Exchange Act (17 CFR 240.13e-4(c))

Securities registered pursuant to Section 12(b) of the Act:

Title of each class		Trading Symbol(s)		Name of each exchange on which registered
Common stock		FIVE		The Nasdaq Stock Market LLC

Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 or Rule 12b-2 of the Securities Exchange Act of 1934.

☐ Emerging growth company

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Item 8.01. Other Events.

On July 15, 2026, Five Below, Inc. (the “Company”) identified anomalous activity on a Company-issued computer belonging to an employee. Upon detection, the Company promptly activated its cybersecurity incident response plan, initiated a forensic investigation, with assistance from third-party cybersecurity experts, and took immediate steps to contain the activity.

The investigation determined that on July 14, 2026, a threat actor used social engineering techniques that enabled unauthorized access to that employee’s Company-issued computer. The threat actor exfiltrated a number of files from the affected computer.

As of the date of this filing, the Company believes that its rapid response efforts successfully contained and terminated the unauthorized access, that the incident was limited to the affected employee’s environment, that no personally identifiable information was accessed or exfiltrated, and that the incident did not affect the Company’s other systems, platforms, data, or environments.

Based on information available as of the date of this filing, the Company does not believe the incident has had, or is reasonably likely to have, a material impact on the Company’s business strategy, operations, financial condition, or results of operations.

Certain statements contained in this Current Report on Form 8-K constitute forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995, including, without limitation, statements regarding the scope, impact, and anticipated consequences of the cybersecurity incident described herein. These forward-looking statements are based on the Company’s current expectations, estimates, and assumptions and are subject to risks and uncertainties that could cause actual results to differ materially, including the risks that the Company may identify additional affected systems or data, that the exfiltrated information may be used in ways harmful to the Company’s competitive position or financial condition, that regulatory authorities may reach conclusions different from those of the Company, or that litigation may result from the incident. The Company undertakes no obligation to update or revise any forward-looking statements, whether as a result of new information, future events, or otherwise, except as required by law.

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized.

Five Below, Inc.
By:		/s/ Daniel J. Sullivan
Name:		Daniel J. Sullivan
Title:		Chief Financial Officer and Treasurer

Date: July 22, 2026

Filing Exhibits & Attachments

3 documents

Other Documents

• EX-101 XBRL TAXONOMY EXTENSION SCHEMA 3.1 KB
• EX-101 XBRL TAXONOMY EXTENSION LABEL LINKBASE 17.6 KB
• EX-101 XBRL TAXONOMY EXTENSION PRESENTATION LINKBASE 11.0 KB