VF Outdoor, LLC
bd_5b713f4a386a366d · schema v1 · pii pii-v1
All records for VF Outdoor, LLC →4 incidents on fileAccount takeover notice
VF Outdoor, LLC notified customers of unauthorized access to their accounts. The filing says: “Following a careful investigation, we concluded that attackers launched a credential stuffing attack against our website, thenorthface.com, between July 26 and August 19, 2022.”
VF Outdoor, LLC (doing business as The North Face and Vans) disclosed a credential stuffing attack against its e-commerce websites. Attackers used stolen credentials to access user accounts between July 26 and August 20, 2022. The incident affected approximately 194,905 individuals in the US, exposing email addresses, passwords, names, addresses, and purchase history. Payment card data was not compromised. The company disabled affected passwords and erased payment tokens.
J jump to incidentP pin to compareR raw source
Incident timeline
Jul 26, 2022
Begins
Aug 11, 2022
Discovered
Sep 5, 2022
Filed
vs. sector median
6 wks faster
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- Oregon State AGbd_3de93dca39660db22022-09-06 · +1dVerified
- Washington State AGbd_5868b39e741c13462022-09-06 · +1dVerified
- Maine State AGbd_7d4bed9d72ecad102022-09-06 · +1dCandidate
Filing propagation · 4 filings · 4 states
View merged incident ↗Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.