Suspected Ransomware Attack Impacts Vans and North Face Owner VF Corp
- Written by Shipra Sanganeria Cybersecurity & Tech Writer
- Fact-Checked by Justyn Newman Former Lead Cybersecurity Editor
VF Corporation, a company that owns popular apparel and footwear brands, suffered a security incident resulting in data theft and operational disruptions.
The incident came to light after VF revealed the incident in a Form 8-K report filed with the US SEC (Securities and Exchange Commission) on December 15, 2023.
According to the disclosure, the incident, which was first detected on December 13, saw hackers access VF’s network to disrupt ‘’business operations by encrypting some IT systems,’’ and steal personal and corporate data.
Although its retail stores around the world would remain open, its ability to fulfill online orders would be impacted. In addition, certain customers would also face issues in placing orders through its e-commerce sites globally.
Moreover, this incident is expected to adversely impact the company’s business operations. ‘’As of the date of this filing, the incident has had and is reasonably likely to continue to have a material impact on the Company’s business operations until recovery efforts are completed,’’ the SEC report revealed.
‘’The Company is working to bring the impacted portions of its IT systems back online and implement workarounds for certain offline operations with the aim of reducing disruption to its ability to serve its retail and brand e-commerce consumers and wholesale customers,’’ it continued.
In addition to mitigation efforts, VF is also investigating the incident with external cybersecurity experts and has notified the concerned federal law agencies. It is also trying to assess the material impact of the attack on its operations and finances.
The company did not reveal any details about the type of data stolen and individuals impacted, and, although no ransomware gang has claimed responsibility for the attack; the timing and modus operandi implies this to be a ransomware attack.
The Denver, Colorado-based VF Corp. is a leading apparel, footwear, and accessories retailer that owns 12 globally recognized brands. With an annual revenue of $11.6 billion, the company operates 1,265 retail stores and employs 35K people worldwide.
Some of its leading brands include Dickies, Supreme, Timberland, Kipling, SmartWool, Altra Running, Eastpak, Napapijri, JanSport, and Icebreaker.
Nuclear Research Lab Data Breach Compromises Personal Information of 45K Individuals
- Written by Shipra Sanganeria Cybersecurity & Tech Writer
- Fact-Checked by Justyn Newman Former Lead Cybersecurity Editor
After confirming the cyberattack incident in November 2023, the Idaho National Laboratory (INL) went on to disclose that hackers had stolen information of tens of thousands of individuals.
The US nuclear research lab is one of the 17 national laboratories operating under the US Department of Energy (DOE) and employs 6,100 researchers involved in nuclear research and security solutions.
The incident notification shared with the Office of the Maine Attorney General revealed that the incident which occurred on November 19, was discovered by INL the very next day. It claimed that the breach did not impact its own network or database, rather its off-site Oracle HCM system that ‘’supports certain INL Human Resources applications.”
Data exfiltration of around 45,047 current and former employees (including postdocs, graduate fellows and interns), dependents, and spouses is said to have occurred. Moreover, employees hired by the Idaho Cleanup Project (ICP) between 2005 until mid-2006 may have also been impacted by this breach. Only employees recruited after June 1, 2023 did not suffer any impact.
The stolen data includes sensitive personally identifiable information like names, social security numbers, salary information, and banking details. Some individuals also had their names and dates of birth information stolen. Data like payroll details for employees, former employees, and retirees that was current as of June 1, 2023 was also compromised.
In response to the attack, affected individuals will be notified via letters as well as provided with free comprehensive credit monitoring services. INL has also advised individuals to freeze their credit report and remain vigilant about suspicious financial transactions on their accounts.
The ongoing investigation is said to be conducted in partnership with DOE, the FBI, the CISA, and other national labs.
On November 20, the incident was claimed by the notorious hacktivist’s group SiegedSec, by leaking stolen information on their Telegram channel and a popular leak forum.
