Cyber-crooks slip into Vans, trample over operations
IT systems encrypted, personal data pilfered from North Face parent, we're told
A digital break-in has disrupted VF Corp's operations and its ability to fulfill orders, according to the apparel and footwear giant.
VF detected the IT system intrusion on December 13, according to a spokesperson and a report filed with the US Securities and Exchange Commission on Monday.
The SEC filing comes as the American securities regulator's rules, which require public companies disclose material cyber incidents, take effect.
VF owns 12 major brands including The North Face, Vans, Dickies, and Icebreaker. While the US-based corp's retail stores around the world remain open, "VF is experiencing certain operational disruptions," the VF spokesperson told The Register.
"At this time, consumers are also able to place orders on most of the brand e-commerce sites globally," the spokesperson added. "However, the company's ability to fulfill orders is currently impacted."
While neither the VF spokesperson nor the Form 8-K specifically call the cybersecurity incident ransomware — the spokesperson declined to answer specific questions about the break-in — it sounds like a ransomware infection with extortion on top. The biz described the intrusion thus:
The threat actor disrupted the company's business operations by encrypting some IT systems, and stole data from the company, including personal data. The company is working to bring the impacted portions of its IT systems back online and implement workarounds for certain offline operations with the aim of reducing disruption to its ability to serve its retail and brand e-commerce consumers and wholesale customers.
Upon discovering the incident, VF "immediately" took steps to contain and remediate it, including hiring an outside cybersecurity firm to investigate, we're told. VF says they are working with federal law enforcement.
Both the corporation and the third-party incident responders continue to "respond to and mitigate the impact from this incident," according to the spokesperson.
- Crooks pwned your servers? You've got four days to tell us, SEC tells public companies
- Clorox CISO flushes self after multimillion-dollar cyberattack
- Kraft Heinz suggests we simmer down about Snatch ransomware attack claims
- MongoDB warns breach of internal systems exposed customer contact info
While the clobber slinger's SEC filing noted that the break-in will likely continue to have a material impact on its business operations, VF hasn't yet determined how high the price of the encryption and data exfiltration will climb.
VF's security incident follows several other digital break-ins at other multinational corporations this year.
This includes the Clorox Company, which disclosed the corporate network breach in August. The intrusion disrupted operations and cost the cleaning-supply manufacturer hundreds of millions of dollars. Clorox's chief security officer left her job last month.
In its SEC filing, MGM disclosed that the September cyberattack will likely cost it at least $100 million. ®