VF Corporation, the parent company of renowned brands such as Vans, Timberland, The North Face, Dickies, and Supreme, has revealed that a staggering 35 million customers fell victim to a ransomware attack in December. Fortunately, the breach did not compromise sensitive information like social security numbers, bank details, or payment card data, as VF Corporation does not store such data on its systems.
In an 8-K form filed with the U.S. Securities and Exchange Commission (SEC), VF Corp stated,
“Based on VF’s preliminary analysis from its ongoing investigation, VF currently estimates that the threat actor stole personal data of approximately 35.5 million individual consumers.”
The company clarified that no consumer passwords were acquired by the threat actor during the attack. The ransomware incident, disclosed on December 15 in an SEC filing, disrupted business operations, leading to the encryption of IT systems and the theft of data, including personal information.
As a response to the breach, VF Corp had to temporarily shut down some systems to contain the incident. The aftermath included disruptions in retail store inventory replenishment, delayed order fulfillment, order cancellations, and delays in wholesale shipments. While the company has substantially restored the encrypted IT systems, minor operational impacts persist.
VF Corp believes the threat actor was expelled from its IT systems on December 15, 2023, and as of the latest SEC filing, its retail stores, brand e-commerce sites, and distribution centers are operating with minimal issues.
Despite the severity of the breach, VF Corp has not yet informed customers through official channels about the incident, the nature of the impacted data, or potential effects on employees, suppliers, resellers, and partners. The company is actively cooperating with federal law enforcement and regulatory authorities in its ongoing investigation to assess the extent of the breach.
VF Corporation, based in Colorado with an annual revenue of $11.6 billion and 35,000 employees, is taking swift action to address the aftermath of the cyberattack on its globally recognized brands.
