Cyberattack compromises 72,000 Levi’s customer accounts
Levi Strauss & Co is requiring customers to reset their passwords after experiencing an intrusion into its systems from hackers.
According to a notice published by the Maine Attorney General ‘s office, on Thursday, June 13. 2024, the denim giant discovered a data breach which had occurred that same day. The cyberattack exposed names and other personal information of 72,231 customers, including 75 Maine residents (which necessitated the San Francisco-based company to contact the Maine attorney general).
In an electronic letter to affected customers, Levi’s said it recently issued a forced password reset after detecting suspicious activity on its website.
"Bad actors have attempted to log into some accounts using email and password combinations obtained elsewhere," Levis said in the notice. "If you re-use your passwords across websites, it is possible they were able to log into your account."
Levi’s said the hackers would have been able to view personal customer information such as order history, name, email, stored addresses, and partial information on any saved payment method including the last four digits of the card number, card type and expiration date.
"It does not appear that any fraudulent purchases were initiated using your information," the company said in the letter. "Our systems do not allow saved payment methods to be used for purchases without a secondary means of authentication."
Levi’s believes the breach is the result of a "credential stuffing" attack where hackers obtain login information from another source and then use bots to test credentials on other sites, as people often share passwords across accounts. The company said it is not the source of the initial compromise of passwords.
Although Levi’s is not currently offering any free credit monitoring services to affected customers, it said it "continually evaluate(s) and identify(ies) improvements to strengthen our website cybersecurity." The company is advising affected customers to reset all passwords across all accounts and to contact its customer support if they detect anything unusual.
In commentary emailed to Chain Store Age, Emily Phelps, director of cybersecurity automation platform Cyware, said this incident underscores a "critical need" for retailers to take robust cybersecurity measures.
"Modernizing security operations and operationalizing threat intelligence sharing are pivotal in defending against such threats," Phelps said in the email. "Ensuring the security of customer information is paramount, and adopting advanced cybersecurity practices is essential in safeguarding trust and maintaining resilience against evolving cyber adversaries."
[Read more: Fraud rises in 2023 for businesses, consumers alike]