North Face, Cartier Hit by Cyber Attacks Exposing Customer Data

Fashion brand The North Face and luxury jeweller Cartier have confirmed cyber attacks that exposed customer data, joining a growing list of high-profile retailers targeted in recent weeks.

Credit: THE NORTH FACE

North Face informed customers via email that it discovered a "small-scale" attack in April. The company said hackers used a method called credential stuffing, where stolen usernames and passwords from other breaches are reused in hopes of gaining access to accounts.

The attackers may have accessed shipping addresses and purchase histories. Affected customers have been advised to change their passwords.

Cartier reported that an "unauthorised party gained temporary access" to its systems. In an email to customers, the company said limited client information was obtained, but passwords and card details were not compromised.

Cartier said it had contained the breach, enhanced its system protections, and reported the incident to authorities.

Both companies confirmed that financial information was not accessed during the breaches.

The incidents come amid a wave of cyber attacks on major retailers. Adidas, Victoria’s Secret, and Harrods have all reported breaches in recent weeks. In April, Marks and Spencer and the Co-op experienced severe operational disruptions due to cyber attacks.

North Face’s parent company, VF Corporation, was also affected by a separate cyber attack in December 2023. That breach impacted another of its brands, Vans, with customers warned their data may be at risk.

Cyber-security experts warn that retailers are increasingly vulnerable due to the large volumes of customer data they store. James Hadley, founder of cyber-security firm Immersive, said retailers are "overflowing with customer information," making them easy targets.

Stolen data can be used by cyber-criminals to impersonate companies and trick victims into revealing more sensitive information. Hadley noted that attackers are often willing to "play the long game."

In May, Adidas confirmed that help desk contact details were stolen. Victoria’s Secret had to take down its US website following a security incident. The Co-op experienced empty shelves, and M&S expects online service disruptions to continue until July.

M&S has estimated the attack will reduce its annual profits by approximately £300 million. On Monday, the company revealed its chief executive’s total pay package had risen to £7 million.

---

• North Face and Cartier confirm customer data breaches

• Financial information was not accessed in either attack

• VF Corporation and other major retailers also affected

Source: BBC