VF Corporation, the US-based owner of clothing brands including Vans, Supreme and The North Face, has confirmed that a cyber attack has affected the company’s ability to fulfill orders ahead of Christmas, one of the biggest retail events of the year.
The company is based in Denver, Colorado he said in a filing with federal regulators that the cyberattack, first detected by the company on December 13, saw hackers disrupt the company’s operations “by encrypting some IT systems and stole data from the company, including personal data,” suggesting a ransomware attack.
As a result, the company says it continues to experience operational disruptions, including its “ability to fulfill orders.”
When TechCrunch attempted to place an order on the Vans website, a message read: “Sorry, due to a logistical disruption, the estimated delivery dates shown in the checkout process are incorrect. You will be notified by email when your item has been shipped and you will then be able to track it with the sender.”
VF Corp. it said in its filing that its worldwide retail stores are open and that consumers can purchase available merchandise online. It’s unclear when the orders are expected to ship, and a company spokesman wouldn’t say when.
When reached by email, a representative for VF Corp. Colin Wheeler provided TechCrunch with a statement echoing the company’s filing with regulators. The company also did not respond to TechCrunch’s questions about the incident say if the company had received a ransom demand from the hackers.
The company has yet to say how it was breached, what kinds of data were accessed and how many people — whether employees, customers or both — are affected by the breach. It is also not known who was behind the attack, which has not yet been claimed by any tracked ransomware group.
In its regulatory filing, VF Corp. warned that the cyberattack would have a “material impact” on its business until its systems were recovered. “As the investigation into the incident is ongoing, the full scope, nature and impact of the incident is not yet known,” the filing said.
VF Corp. disclosed the incident on the same day the US Securities and Exchange Commission’s new data breach disclosure rules went into effect. This regulation means organizations must report cybersecurity incidents, including data breaches, to the federal government’s securities regulator within four working days.
