In early August 2025, the cybercrime collective Scattered Spider publicly exposed screenshots of console access to Victoria's Secret systems, indicating unauthorized access and potential data exfiltration. The group, collaborating with other extortion factions like ShinyHunters and Lapsus$, shared partial customer data samples, suggesting a breach of sensitive information. The attack involved spear-phishing and exploited VPN credentials, followed by in-memory execution of malicious payloads to evade detection. The incident highlights the group's shift toward real-time data theft and extortion, posing significant risks to the company's customer data and operational security.

Retail Cyberattacks Surge: Victoria’s Secret, The North Face, and Cartier Among Latest Victims A wave of cyberattacks has targeted major retailers in recent weeks, disrupting operations and exposing customer data. Victoria’s Secret, The North Face, and Cartier are among the latest brands to report security breaches, highlighting the growing threat to the retail sector. Victoria’s Secret Hit by Undisclosed Cyberattack Victoria’s Secret experienced a security incident in late May, forcing the company to shut down its website and pause some in-store services from May 26 to May 29, 2025. While stores remained open, the outage delayed the company’s fiscal Q1 earnings report, though financial results released on June 11 showed net sales of $1.35 billion, exceeding expectations. However, the breach is projected to cost the company $20 million in Q2 net sales due to service disruptions. The North Face and Cartier Report Separate Breaches The North Face, owned by VF Corp., disclosed a "small-scale" credential-stuffing attack in April 2025, where hackers used leaked login details from other breaches to access customer accounts. No financial data was compromised, but names and emails were exposed. Luxury brand Cartier also confirmed a breach, revealing that an unauthorized party accessed customer data, including purchase history, shipping addresses, birth dates, and phone numbers. The company did not specify when the attack occurred. Retail Sector Under Siege These incidents follow a string of attacks on other retailers this month, including Marks & Spencer, Dior, Harrods, and Adidas. The Adidas breach, linked to a third-party customer service provider, underscored the risks of supply chain vulnerabilities. Cybersecurity experts warn that retailers are prime targets due to the vast amounts of sensitive customer data they handle, with 46% of retail security professionals reporting data loss from attacks in the past year. The financial and reputational toll is significant companies face network outages, customer account compromises, and long-term trust erosion, with some losing over 10% of annual revenue after breaches. While details of the Victoria’s Secret attack remain undisclosed, the incident reflects a broader trend of coordinated or opportunistic attacks on the retail industry.

Victoria’s Secret experienced a cyber attack in late May 2025, forcing the company to shut down its website and pause some in-store services from May 26 to May 29. The incident disrupted operations, delayed Q1 financial reporting, and resulted in an estimated $20 million loss in Q2 net sales due to service outages. While no customer data breach was explicitly confirmed in the article, the attack caused significant operational disruption, including halted online transactions, paused customer care services, and extended return/reward windows to mitigate customer impact. The company’s restoration efforts delayed financial reporting, highlighting the attack’s severity in terms of business continuity and financial repercussions. The incident aligns with a broader trend of targeted retail cyber attacks, emphasizing vulnerabilities in e-commerce and in-store systems.

The breach notification was reported by Victoria's Secret on May 13, 2021, regarding unauthorized access to certain personal information in customer online accounts between April 13, 2021, and April 14, 2021. The compromised information included names, email addresses, postal addresses, birthdays (month and day), telephone numbers, and linked gift card details. The company has advised customers to change their passwords and monitor their accounts for suspicious activity.