VF Corporation reported a ransomware attack in one of the first SEC cyber filings

VF Corporation, the apparel group behind Vans, The North Face, Timberland, Supreme and JanSport, told the U.S. Securities and Exchange Commission that it detected unauthorized activity on part of its information technology estate on December 13, 2023. The company shut down affected systems, engaged outside cybersecurity specialists and notified federal law enforcement.

The filing said the intruders encrypted some IT systems and stole company data, including personal data, but did not quantify how many people were involved. VF's Form 8-K was among the first filed under the SEC's new rule requiring registrants to report material cybersecurity incidents. SEC records show the Item 1.05 filing was made on December 18, 2023, the rule's first day, and give December 15, 2023 as the date of the earliest event reported, which is when VF determined the incident was material.

VF said its retail stores worldwide stayed open and most brand e-commerce sites kept taking orders, but that its ability to fulfill those orders was materially disrupted at the peak of the holiday shopping season. The company said the incident was reasonably likely to keep having a material effect on operations until recovery was complete, and that it could not yet estimate the financial impact.

No group had claimed the attack at the time of the initial filing. VF later reported to the SEC that the personal data of about 35.5 million consumers was taken, saying no Social Security numbers or financial account information were involved, and the AlphV ransomware operation was subsequently linked to the intrusion.