VF Corporation

VF Corporation's Fiscal 2024 Form 10-K Item 1C references a previously disclosed December 2023 cybersecurity incident affecting its IT systems. The company states impacts were not material to financial condition or results of operations. VF is seeking reimbursement from cybersecurity insurers. No specifics on attack vector, affected individuals, or data types are provided in this Item 1C narrative.

VF Corporation filed an 8-K/A amending its December 18, 2023 disclosure of a cybersecurity incident detected December 13, 2023. The threat actor was ejected December 15, 2023. Preliminary investigation estimates personal data of approximately 35.5 million individual consumers was stolen. VF does not retain SSNs, bank account, or payment card data; no evidence consumer passwords were acquired. Operations have substantially recovered.

VF Corporation is an American global apparel and footwear company founded in 1899 by John Barbey and headquartered in Denver, Colorado. The company's 13 brands are organized into three categories: Outdoor, Active and Work. In 2015, the company controlled 55% of the U.S. backpack market with the JanSport, Eastpak, Timberland, and The North Face brands.

On December 13, 2023, V.F. Corporation detected unauthorized activity on a portion of its IT systems. A threat actor encrypted some IT systems and stole data, including personal data. The Company activated its incident response plan, engaged external cybersecurity experts, shut down some systems, and notified federal law enforcement. The incident has had and is reasonably likely to continue to have a material impact on business operations. Disclosed via Item 1.05 8-K filed December 18, 2023.

VF Outlet, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2016-09-28. 215 Massachusetts residents were affected. The report records the breach type as electronic.