Cyberattack compromises 72,000 Levi’s customer accounts

Levi Strauss & Co is requiring customers to reset their passwords after experiencing an intrusion into its systems from hackers.

According to a notice published by the Maine Attorney General ‘s office, on Thursday, June 13. 2024, the denim giant discovered a data breach which had occurred that same day. The cyberattack exposed names and other personal information of 72,231 customers, including 75 Maine residents (which necessitated the San Francisco-based company to contact the Maine attorney general).

In an electronic letter to affected customers, Levi’s said it recently issued a forced password reset after detecting suspicious activity on its website. 

"Bad actors have attempted to log into some accounts using email and password combinations obtained elsewhere," Levis said in the notice. "If you re-use your passwords across websites, it is possible they were able to log into your account."

Levi’s said the hackers would have been able to view personal customer information such as order history, name, email, stored addresses, and partial information on any saved payment method including the last four digits of the card number, card type and expiration date. 

"It does not appear that any fraudulent purchases were initiated using your information," the company said in the letter. "Our systems do not allow saved payment methods to be used for purchases without a secondary means of authentication."

Levi’s believes the breach is the result of a "credential stuffing" attack where hackers obtain login information from another source and then use bots to test credentials on other sites, as people often share passwords across accounts. The company said it is not the source of the initial compromise of passwords.