Cyber-crooks slip into Vans, trample over operations

A digital break-in has disrupted VF Corp’s operations and its ability to fulfill orders, according to the apparel and footwear giant.

VF detected the IT system intrusion on December 13, according to a spokesperson and a report filed with the US Securities and Exchange Commission on Monday.

The SEC filing comes as the American securities regulator’s rules, which require public companies disclose material cyber incidents, take effect.

VF owns 12 major brands including The North Face, Vans, Dickies, and Icebreaker. While the US-based corp’s retail stores around the world remain open, “VF is experiencing certain operational disruptions,” the VF spokesperson told The Register. 

“At this time, consumers are also able to place orders on most of the brand e-commerce sites globally,” the spokesperson added. “However, the company’s ability to fulfill orders is currently impacted.”

While neither the VF spokesperson nor the Form 8-K specifically call the cybersecurity incident ransomware — the spokesperson declined to answer specific questions about the break-in — it sounds like a ransomware infection with extortion on top. The biz described the intrusion thus:

Upon discovering the incident, VF “immediately” took steps to contain and remediate it, including hiring an outside cybersecurity firm to investigate, we’re told. VF says they are working with federal law enforcement. 

Both the corporation and the third-party incident responders continue to “respond to and mitigate the impact from this incident,” according to the spokesperson.

While the clobber slinger’s SEC filing noted that the break-in will likely continue to have a material impact on its business operations, VF hasn’t yet determined how high the price of the encryption and data exfiltration will climb.

VF’s security incident follows several other digital break-ins at other multinational corporations this year.

This includes the Clorox Company, which disclosed the corporate network breach in August. The intrusion disrupted operations and cost the cleaning-supply manufacturer hundreds of millions of dollars. Clorox’s chief security officer left her job last month.

Also over the summer, two high-profile Las Vegas hotel and casino operators, Caesars Entertainment and MGM Resorts, fell victim to the same ransomware gang.

In its SEC filing, MGM disclosed that the September cyberattack will likely cost it at least $100 million. ®

READ MORE HERE