Victoria's Secret Stores Brand Management, LLC

On April 13, 2021, Victoria’s Secret (VS) discovered that an unauthorized party had gained access to certain online customer accounts. The breach, which lasted approximately 11 hours, is believed to have resulted from credential stuffing, where attackers used login information compromised in a breach of another company. The compromised data included names, contact information, birth day and month, and linked gift card numbers and PINs. The last four digits of saved payment cards were also visible. VS secured the affected accounts, prompted password resets, and offered one year of free identity protection services to the 116 affected individuals.