VF Corp North Face Breach: 35 Million Customers Hit in Retail Cyberattack

VF Corporation, the parent company of The North Face, Vans, Timberland, and other major brands, disclosed a ransomware attack that compromised personal data of approximately 35.5 million customers. The ALPHV/BlackCat ransomware group claimed responsibility for the attack, which disrupted operations including order fulfillment, inventory management, and e-commerce platforms during the critical holiday shopping season. The stolen data included names, email addresses, phone numbers, mailing addresses, and in some cases payment card information and purchase history. VF Corp stated that Social Security numbers and bank account details were not compromised. The attack disrupted operations for weeks, with customers unable to place orders or track shipments across multiple brand websites. The breach demonstrated the risk concentration in retail conglomerates where a single parent company compromise cascades across numerous consumer brands simultaneously.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.