DisclosureLens
HackingRetail & ConsumerRetailStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)PIIMediumContained

VF Outdoor, LLC

bd_460bed5b5e37a806 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 23, 2025

Filed

May 29, 2025

To disclose

5 weeks

Affected · nationwide

2,86112 in this filing

Linked

8 filings

Confidence

65%
All records for VF Outdoor, LLC →4 incidents on file

Account takeover notice

VF Outdoor, LLC notified customers of unauthorized access to their accounts. The filing says: “Following a careful and prompt investigation, we concluded that an attacker had launched a small-scale credential stuffing attack against our Website on April 23, 2025.”

VF Outdoor, LLC (dba The North Face) reported a credential stuffing attack on April 23, 2025, affecting 2,861 individuals, including 12 Maine residents. The attacker used stolen credentials to access user accounts, potentially exposing names, addresses, and contact info. No payment card data was compromised. Notifications were sent on May 29, 2025.

Maine clockDiscovered Apr 23, 2025 → Filed with AG May 29, 202536d ⏱ ME AG >30d5 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 5 weeks / 36 days

Apr 23, 2025

Begins

Apr 23, 2025

Discovered

May 29, 2025

Filed

vs. sector median

4 wks faster

This filing is one of 8 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Show 3 more filings ↓up to 58d gap

Filing propagation · 8 filings · 5 states

View merged incident ↗
Illinois State AGApr 1 · first
California State AG+3d
Nebraska State AG+3d
Maine State AG+3d
Vermont State AG+7d
Nebraska State AG+58d
Vermont State AG+58d
Maine State AG+58d · this page

Pattern: first filing Apr 1 (IL), last May 29 (ME) — a 58-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.