Levi Strauss Reports Cybersecurity Breach Following Social Engineering Attack
Levi Strauss & Co. has confirmed that cybercriminals gained unauthorized access to company systems after successfully targeting employees through a social engineering scheme, leading to the theft of corporate data.
The denim and apparel major disclosed the incident in a regulatory filing with the U.S. Securities and Exchange Commission (SEC), stating that the breach involved three company-issued employee computers. The attackers were able to manipulate employees into granting access, allowing them to obtain and remove certain company information.
While the company acknowledged that corporate data was compromised, it emphasized that customer information was not affected. Levi Strauss also stated that the incident did not disrupt operations and is not expected to have a material impact on the company’s business performance or financial position.
Upon detecting the unauthorized activity, the company activated its cybersecurity response procedures, implemented containment measures and brought in external cybersecurity specialists to assist with the investigation. According to the company, the unauthorized access has been contained, although the investigation remains ongoing.
Levi Strauss has not disclosed the type of social engineering method used in the attack or the nature and volume of the information that was accessed. The company also said there is currently no indication that the incident involved ransomware, system encryption or extortion attempts.
The company is continuing to assess the full scope of the breach and has begun notifying relevant stakeholders and regulatory authorities where required.
The incident underscores the increasing sophistication of cyber threats targeting employees rather than technology systems. As businesses strengthen their digital infrastructure, attackers are increasingly exploiting human vulnerabilities to gain access to sensitive corporate information.
Levi Strauss said further details may emerge as the investigation progresses and the extent of the data exposure is fully determined.
