HackingRetail & ConsumerRetailStolen CredentialsTargetedCustomer Data InvolvedPIIIdentity (basic)Financial accountLowContained

Levi Strauss & Co.

bd_ba58543d29f42753 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 13, 2024

Filed

Jun 20, 2024

To disclose

—

Affected

65state residents only

Linked

8 filings

Confidence

67%

Full breach record for Levi Strauss & Co. →4 incidents on file

Levi Strauss & Co. detected a credential stuffing attack on June 13, 2024, where bad actors used stolen credentials from third-party breaches to access user accounts. The company forced password resets and deactivated compromised accounts. Affected data included names, emails, addresses, order history, and partial payment card details. No fraudulent purchases were initiated.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 days

Jun 13, 2024

Discovered

Jun 20, 2024

Filed

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Vermont State AGbd_d5e768930b4a70602024-06-20Verified
Oregon State AGbd_3b1eebcb107db0ad2024-06-21 · +1dVerified
Washington State AGbd_af1f821586c29af72024-06-21 · +1dVerified
Indiana State AGbd_bef76f3f16d22f202024-06-21 · +1dVerified

Show 3 more filings ↓up to 2d gap

New Hampshire State AGbd_c9110f3671bb06de2024-06-21 · +1dVerified
California State AGbd_da3a3e26c0353b712024-06-21 · +1dVerified
Maine State AGbd_7e8e7bdd4378db662024-06-22 · +2dVerified

Name: Levi Strauss & Co.
norm: levi strauss

Name: Levi Strauss & Co.
norm: levi strauss
Industry: Retail & Consumerllm

Discovered: Jun 13, 2024
Materiality determined: —
Notification sent: —
Affected individuals: 65state-resident count only
Data types: PIIIdentity (basic)Financial account
Attack vector: Phishing
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Issued a forced password reset
De-activating account credentials for all user accounts that were accessed
Conducted a diligent investigation to confirm the nature and scope of the incident
Changes made: Continually evaluate and identify improvements to strengthen our website cybersecurity
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Vermont State AGJun 20 · first

Montana State AGJun 20 · first · this page

Oregon State AG+1d

Washington State AG+1d

Indiana State AG+1d

New Hampshire State AG+1d

California State AG+1d

Maine State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1497.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 20, 2024
Raw hash: a11f8adfbc0548ac3ec96a14426126a578a4fe15b0161cd0dd64e3720883988c

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityLevi Strauss & Co.

Victim entityLevi Strauss & Co.

Incidentdiscovered Jun 13, 2024

Stated responseIssued a forced password reset

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov