Levi Strauss Hit by Cyberattack Corporate Data Stolen

What Happened

August 10, 2026 - Levi Strauss & Co, one of the most iconic names in denim apparel, disclosed on Friday that it had fallen victim to a cyberattack. The company made the announcement through an official Form 8-K filing with the U.S. Securities and Exchange Commission (SEC), confirming that attackers had successfully breached its systems by targeting a small number of employees and exfiltrated certain corporate data.

The company stated that its cybersecurity teams initiated an immediate response upon detecting the incident and successfully evicted the attackers from its systems. Levi's emphasized that the cyberattack caused no disruption to its business operations, which are continuing as normal. Furthermore, the company added that it does not expect the incident to have a "material impact" on its financials. This term is typically used to indicate that the attack is not considered severe enough to significantly affect the company's financial statements or stock value.

A comprehensive investigation into the attack is ongoing, with Levi's working alongside cybersecurity experts and external consultants to fully understand the scope of the incident. The company also noted its cooperation with law enforcement authorities. Such incidents serve as a stark reminder that even the largest and most established brands remain vulnerable to persistent cyber threats.

What Data Was Compromised

According to the official statement from Levi Strauss, the attackers managed to access and exfiltrate "certain corporate information." The company has refrained from providing a detailed inventory of the stolen data but made a point to emphasize that, based on preliminary findings, no customer data was compromised in this breach. This suggests that sensitive customer information, such as personal details, credit card numbers, or order histories, remains secure.

So, what does "corporate information" entail? This term generally covers data related to a company's internal operations. While the exact nature of the stolen data remains unclear, such information could potentially include:

• Internal corporate communications and emails
• Financial reports and budget documents
• Design and marketing strategies for future collections
• Information regarding supply chain and logistics operations
• Limited corporate data related to employees

The theft of this type of data, while not as publicly alarming as a customer data breach, poses significant risks to the company. If it falls into the hands of competitors, it could lead to the exposure of trade secrets, eroding the company's competitive advantage. There is also the risk that the attackers could use this information to extort the company or plan more sophisticated attacks in the future. More specific details about the scope of the exfiltrated data are expected to be shared as the investigation progresses.

How the Attack Happened

Levi's confirmed that the attack was executed using "social engineering" techniques. This method relies on the psychological manipulation of individuals to trick them into divulging confidential information or performing actions, rather than exploiting technical vulnerabilities. The company specified that the attack affected company-issued computers belonging to three employees. This indicates a targeted operation aimed at individuals rather than a widespread system vulnerability.

The company did not disclose the specific type of social engineering technique used. However, some unconfirmed reports suggest a link to a hacking group known as UNC6671, which has been associated with recent voice phishing (vishing) campaigns. Vishing is a form of social engineering where attackers contact victims by phone, impersonating trusted entities like the IT department, a manager, or a business partner, to trick them into revealing sensitive information such as passwords or authentication codes. These claims have not yet been confirmed by Levi's or independent security researchers.

Social engineering attacks typically follow these steps:

1. Reconnaissance: Attackers gather information about their targets from social media and other open sources.
2. Building Trust: Using the gathered information, they impersonate a legitimate person or entity to gain the victim's trust.
3. Manipulation: They persuade the victim to perform a desired action, such as clicking a link, downloading a file, or sharing a password.

In the Levi's case, it is believed that the attackers used this or a similar method to deceive three employees, gain access to their computers, and subsequently access corporate data. The company stated that upon detection, unauthorized access to these computers was immediately terminated and the systems were secured.

Who Is Affected

Several groups are directly and indirectly affected by this cyberattack.

• Levi Strauss & Co: The company is the primary target and the most affected party. The theft of corporate data brings risks of trade secret exposure, reputational damage, and significant investigation costs.
• The Three Targeted Employees: The employees who were deceived by the attackers are direct victims of the incident. This can be a challenging experience, both personally and professionally. No statement has been made regarding whether any of their personal data was also at risk.
• Investors and Shareholders: The company's filing with the SEC indicates the event's potential significance to investors. Although a "material impact" is not expected, such security breaches can slightly shake investor confidence.

Since Levi's has stated that, based on initial findings, customer data was not affected, Levi's customers are not believed to be directly impacted by this incident. This means there is currently no need for customers to change their passwords or monitor their accounts in relation to this breach.

What You Can Do

Even though Levi's has stated that customer data was not impacted, news of this nature can create new opportunities for cybercriminals. There are several precautions that both individual users and employees of other companies should take.

Advice for Levi's Customers

Cybercriminals often leverage news about major brands to launch secondary phishing campaigns. They might send emails pretending to be from Levi's, asking you to "secure your account" or "reset your password." Do not fall for this trap.

• Be suspicious of any emails or text messages claiming to be from Levi's that ask you to urgently click a link or enter personal information.
• If you need to access your account, do so by typing the official Levi's website address directly into your browser, rather than clicking on a link in an email.
• Remember: The company has stated that customer data was not affected. Therefore, approach any communication claiming otherwise with extreme skepticism.

A Lesson for All Employees

This attack is a testament to how even the most robust defense systems can be undermined by the human element. To avoid falling for a similar trap at your own workplace:

• Verify Requests: If you receive an unexpected or urgent request from your IT department or a manager (e.g., "Install this program now" or "Enter your password here"), always verify it through a separate communication channel (e.g., a phone call).
• Scrutinize Suspicious Emails: Carefully check the sender's address, look for grammatical errors, and be wary of any language that creates a sense of urgency or panic.
• Be Sparing with Information: Never share your password, multi-factor authentication (MFA) codes, or other sensitive information via email or phone.
• Participate in Training: Actively participate in your company's cybersecurity and social engineering awareness training and apply what you learn in your daily workflow.

What the Company Is Saying

In its Form 8-K filing with the SEC, Levi Strauss & Co aimed for transparency, stating: "Based on preliminary findings from the company’s investigation, the company believes that certain corporate information was accessed and exfiltrated as a result of the incident."

The filing also noted that the company responded immediately upon discovering the incident and successfully evicted the attackers from its systems. "The company has not experienced any interruption in business operations as a result of the incident," the statement read, emphasizing operational continuity.

Levi's has not commented on who might be behind the attack or whether it has received any ransom demands. Inquiries to the company's PR department for additional details went unanswered, with a representative telling SecurityWeek that no further information could be shared while the investigation is ongoing.

Source

https://www.securityweek.com/corporate-data-stolen-in-levi-strauss-cyberattack/