VF Corp., the parent company of popular apparel brands Vans, Supreme, and The North Face, announced on Thursday that hackers accessed the personal data of 35.5 million customers in a cyberattack in December. The Denver, Colorado-based company reported the breach in a filing with regulators, but did not specify the types of data stolen or if they know exactly what was taken. The company spokesperson did not provide further details when contacted for more information.
VF Corp assured that it does not retain Social Security numbers, bank account information, or payment card information for its consumer businesses, and does not have evidence that customer passwords were stolen. The company had previously mentioned that the hackers disrupted its operations by encrypting some IT systems, indicating a ransomware attack. The group known as ALPHV (or BlackCat) claimed responsibility for the breach.
The company reported experiencing operational disruptions and delays in fulfilling orders at the time of the incident. In their Thursday filing, they mentioned that while they are still dealing with minor residual impacts from the cyber incident, they have caught up on fulfilling delayed orders and have substantially restored the impacted IT systems and data.
The company also included a note inviting anyone with more information on the cyberattack to contact them via email or share files and documents with TechCrunch via SecureDrop.
