Victoria's Secret takes down U.S. website after security incident

Victoria's Secret took its U.S. e-commerce site offline in late May 2025 after what the retailer described only as a security incident. Shoppers began reporting problems around Monday 26 May, during a Memorial Day promotion, and by Thursday 29 May the site had been replaced with a plain holding message.

The Ohio based company said it had identified the incident, enacted its response protocols and engaged third party experts, and that it had taken down the website and some in store services as a precaution. Physical stores stayed open, but customers could not return online orders in person, and the customer care operation went dark, cutting off chat, email and telephone support.

The disruption reached corporate staff as well. Employees reported being locked out of company email accounts, and some office operations were halted. Victoria's Secret said it was working to fulfil orders placed before the outage began, extended its U.S. return window by an additional 30 days and pushed back redemption deadlines on direct mail coupons.

The company declined to say what type of attack it had suffered, whether customer data was taken, or when full service would resume, and gave no restoration timeline. Its shares fell about 4 percent by midday on 29 May as the outage continued. As of that date the retailer said only that its team was working around the clock to restore operations.