HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedTargetedAuthenticationCredentialsIdentity (basic)PIIMediumContained

VF Outdoor, LLC

bd_5868b39e741c1346 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 20, 2022

Filed

Sep 6, 2022

To disclose

17 days

Affected · nationwide

32,0821,460 in this filing

Linked

4 filings

Confidence

69%

All records for VF Outdoor, LLC →4 incidents on file

Account takeover notice

VF Outdoor, LLC notified customers of unauthorized access to their accounts. The filing says: “Following a careful investigation, we concluded that an attacker launched a credential stuffing attack against our website, vans.com, on August 19 and 20, 2022.”

VF Outdoor, LLC (Vans) disclosed a credential stuffing attack on vans.com occurring August 19-20, 2022. The incident affected 32,082 individuals nationwide, including 1,460 in Washington. Compromised data included names, emails, passwords, and account details. Payment card data was not compromised. Vans disabled passwords and tokens for affected accounts.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d17 days discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 17 days

Aug 19, 2022

Begins

Aug 20, 2022

Discovered

Sep 6, 2022

Filed

vs. sector median

7 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Oregon State AGbd_3de93dca39660db22022-09-06Verified
Maine State AGbd_7d4bed9d72ecad102022-09-06Candidate
California State AGbd_5b713f4a386a366d2022-09-05 · +1dVerified

Name: VF Outdoor, LLC
norm: vf outdoor
Domain: thenorthface.com

Name: VF Outdoor, LLC
norm: vf outdoor
Domain: thenorthface.com
Industry: Retail & Consumerllm

Discovered: Aug 20, 2022
Account access: Aug 19, 2022 – Aug 20, 2022
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 32,082state + nationwide
Data types: PIIIdentity (basic)Credentials
Data elements: NameDate of birthUsername + password
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Phishing
MITRE ATT&CK: T1078 Valid AccountsT1110 Brute Force
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Disabling passwords and erasing payment card tokens from accounts that were accessed during the attack timeframe
Continuing to monitor our systems for suspicious activity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGSep 5 · first

Oregon State AG+1d

Maine State AG+1d

Washington State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15011.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 6, 2022
Raw hash: 7ef2dd43bb4945124892549c3e05b8724f0fbd158341f49b3811e8ef46b6d493

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityVF Outdoor, LLC

Victim entityVF Outdoor, LLC

Incidentdiscovered Aug 20, 2022

Stated responseDisabling passwords and erasing payment card tokens from accounts that were accessed during the attack timeframe

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com