VF Corporation data breach (2023)

Breach window
Dec 13, 2023 → Dec 15, 2023
When the intrusion reportedly occurred, per the linked filings
Breach discovered
Dec 13, 2023
Reported by SEC 8-K filings
Materiality determined
Dec 15, 2023
Registrant determined the incident material — starts the SEC 4-business-day clock
FEDERALSEC 8-KFirst filing
Filed Dec 18, 2023bd_b9037e596ac83596
On December 13, 2023, V.F. Corporation detected unauthorized activity on a portion of its IT systems. A threat actor encrypted some IT systems and stole data, including personal data. The Company activated its incident response plan, engaged external cybersecurity experts, shut down some systems, and notified federal law enforcement. The incident has had and is reasonably likely to continue to have a material impact on business operations. Disclosed via Item 1.05 8-K filed December 18, 2023.
SEC 4-day OK · 3d
GLOBALClaimed by ALPHV / BlackCatlinked via shared-victim match · 100%
Posted to leak site Dec 22, 2023bd_60c72c0902ed8ec8
VF Corporation is an American global apparel and footwear company founded in 1899 by John Barbey and headquartered in Denver, Colorado. The company's 13 brands are organized into three categories: Outdoor, Active and Work. In 2015, the company controlled 55% of the U.S. backpack market with the JanSport, Eastpak, Timberland, and The North Face brands.
FEDERALSEC 8-KMost recentlinked via shared-victim match · 100%
Filed Jan 18, 2024bd_0faf1d6a18a23d60
VF Corporation filed an 8-K/A amending its December 18, 2023 disclosure of a cybersecurity incident detected December 13, 2023. The threat actor was ejected December 15, 2023. Preliminary investigation estimates personal data of approximately 35.5 million individual consumers was stolen. VF does not retain SSNs, bank account, or payment card data; no evidence consumer passwords were acquired. Operations have substantially recovered.
Affected (this filing): 35,500,000

VF Corporation

Litigation Timing

Timeline