Vans warns customers of fraud risk after data breach

Footwear brand Vans has advised customers to stay vigilant after attackers accessed their personal details during a breach of Vans owner VF Corp.

Vans informed its customers about an elevated risk of identity theft, phishing, and fraud after attackers accessed customer data during the December 13th, 2022, breach.

The attack, since claimed by the ALPHV/BlackCat ransomware gang, forced VF Corp to shut down parts of its IT infrastructure, creating holiday season havoc for the global manufacturer of brands like The North Face, Vans, Timberland, and more.

Vans told customers that cybercriminals accessed personal customer information, such as email addresses, full names, phone numbers, billing addresses, and shipping addresses. In some cases, the attackers also accessed order histories, total order values, and information about what payment method was used for the purchases.

“Please note that, in any event, we never collect or retain in our IT systems any detailed payment/financial information, such as, for example, bank account or credit card information, so there is no chance that any detailed financial information was exposed to the threat actors,” the brand’s statement said.

Vans customers are advised to stay vigilant, carefully considering emails, SMS, and other instant messages, as well as phone calls, even if they seem to be coming from the company.

Customers were instructed to watch out for emails with embedded hyperlinks, as those could lead to malicious websites. Moreover, individuals should be wary of email attachments and any suspicious emails, even if they appear to come from people they know.

The breach of VF Group has impacted the personal information of over 35 million individuals, a breach disclosure that the company amended with the US Securities and Exchange Commission (SEC) revealed.

The publicly traded company has more than 1265 retail stores and a revenue of $11 billion, according to its website.

Soon after the attack on VF Corp, the Russian-linked ALPHV/BlackCat group had its own operational problems after the FBI seized one of its domain controllers, shutting down its dark leak blog (which VF Corp had been listed on by the end of December).

Known for its triple-extortion tactics, ALPHV/BlackCat joined forces with Scattered Spider to carry out the September 2023 attacks on two Las Vegas casino giants, MGM Resorts and Caesars International.