HackingRetail & ConsumerRetailStolen CredentialsTargetedCustomer Data InvolvedIdentity (basic)Financial accountMediumContained

Levi Strauss & Co.

bd_7e8e7bdd4378db66 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 13, 2024

Filed

Jun 22, 2024

To disclose

9 days

Affected · nationwide

72,23175 in this filing

Linked

8 filings

Confidence

66%

All records for Levi Strauss & Co. →4 incidents on file

Account takeover notice

Levi Strauss & Co. notified customers of unauthorized access to their accounts. The filing says: “Our investigation showed characteristics associated with a “credential stuffing” attack where bad actor(s) who have obtained compromised account credentials from another source (such as a third-party data breach) then use a bot attack to test these credentials against another website – in this case www.levis.com.”

Levi Strauss & Co. reported a credential stuffing attack on June 13, 2024, affecting 72,231 individuals, including 75 Maine residents. Attackers used stolen credentials to access accounts, viewing order history, names, emails, addresses, and partial payment info. LS&Co forced password resets and deactivated compromised accounts. No fraudulent purchases were detected.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 13, 2024 → Filed with AG Jun 22, 20249d ✓ ME AG ≤30d9 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 9 days

Jun 13, 2024

Begins

Jun 13, 2024

Discovered

Jun 22, 2024

Filed

vs. sector median

8 wks faster

This filing is one of 8 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Oregon State AGbd_3b1eebcb107db0ad2024-06-21 · +1dVerified
Washington State AGbd_af1f821586c29af72024-06-21 · +1dVerified
Indiana State AGbd_bef76f3f16d22f202024-06-21 · +1dVerified
New Hampshire State AGbd_c9110f3671bb06de2024-06-21 · +1dVerified

Show 3 more filings ↓up to 2d gap

California State AGbd_da3a3e26c0353b712024-06-21 · +1dVerified
Montana State AGbd_ba58543d29f427532024-06-20 · +2dCandidate
Vermont State AGbd_d5e768930b4a70602024-06-20 · +2dVerified

Name: Levi Strauss & Co.
norm: levi strauss
Domain: levi.com

Name: Levi Strauss & Co.
norm: levi strauss
Domain: levi.com
Industry: Retail & Consumerllm

Discovered: Jun 13, 2024
Account access: Jun 13, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 21, 2024
Affected individuals: 72,231state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1110.003 Brute Force: Password SprayingT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Issued a forced password reset
De-activated account credentials for all user accounts that were accessed during the relevant time period
Conducted a diligent investigation to confirm the nature and scope of the incident
Changes made: Continually evaluate and identify improvements to strengthen website cybersecurity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 days(9 days from discovery to filing)
Compliance flags: ME AG ≤30d · 9d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 13, 2024
→ Filed with AG: Jun 22, 2024
9d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 13, 2024 → Filed with AG: Jun 22, 2024	9d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Montana State AGJun 20 · first

Vermont State AGJun 20 · first

Oregon State AG+1d

Washington State AG+1d

Indiana State AG+1d

New Hampshire State AG+1d

California State AG+1d

Maine State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/8030ec41-f822-46aa-9cd9-cace85ab4bae.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 22, 2024
Raw hash: a9bc27a28c56633687d7aed5e57eac2972a64fabbaccb12c2c07ba302859213d

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityLevi Strauss & Co.

Victim entityLevi Strauss & Co.

Incidentdiscovered Jun 13, 2024

Stated responseIssued a forced password reset

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov