The North Face, a prominent fashion brand under VF Corporation, fell victim to a small-scale cyber attack in April 2025, where hackers employed credential stuffing—a technique leveraging stolen usernames and passwords from prior breaches to exploit reused credentials. The attackers gained unauthorized access to customer accounts, compromising personal data such as names, email addresses, shipping addresses, and purchase histories. While financial information (e.g., payment card details) remained secure, the breach exposed sensitive customer profiles, raising concerns over potential phishing or identity fraud risks. Affected users were instructed to reset passwords. This incident follows a separate 2023 cyber attack on VF Corporation’s brand Vans, highlighting recurring vulnerabilities in the group’s digital infrastructure. The UK’s National Crime Agency prioritized investigating the attack amid a broader surge in retail-targeted cybercrime, including breaches at Adidas, Victoria’s Secret, and Harrods.

Outdoor apparel brand 'The North Face' suffered a large-scale credential stuffing attack that resulted in the hacking of 194,905 accounts on the thenorthface.com website. The attack affected about 200,000 accounts and compromised information like full name, purchase history, billing address, shipping address, contact number, XPLR Pass reward records, and other information. The North Face reset all user passwords and wiped out all payment card tokens on accounts accessed by unauthorized intruders. The impacted customers with an account on the website were also asked to enter a new password and re-enter their payment card details to make a purchase.

The California Office of the Attorney General reported that VF Outdoor, LLC, doing business as The North Face®, experienced a credential stuffing attack on October 8 and 9, 2020. The breach potentially compromised personal information including email addresses, passwords, names, birthdays, and contact details, affecting an unspecified number of individuals. The report was issued on November 5, 2020.