Levi Strauss & Co. is investigating a data breach that resulted from a social engineering attack, which allowed unauthorized access to three employee work computers. The apparel manufacturer confirmed in a regulatory filing that attackers accessed and exfiltrated "certain corporate information."
The company detected the intrusion, initiated its incident response protocols, and engaged external cybersecurity specialists to contain the breach and terminate the unauthorized access. The investigation into the incident is ongoing.
Levi's has stated that its preliminary findings indicate no consumer data was compromised in the attack. Furthermore, the company reported no disruption to its operations and does not anticipate a material impact on its business based on current information. Affected parties and regulatory bodies will be notified as required by law.
While Levi's has not disclosed further specifics about the incident, it has been reported that the company was among over 200 organizations targeted in a broader social engineering campaign over the past five weeks. This campaign, tracked by Google researchers, is believed to involve multiple groups potentially operating under an umbrella entity identified as UNC6671.
The attackers in this wider campaign employed a tactic of telephoning employees on their personal mobile phones, impersonating colleagues or IT support personnel. They then directed these employees to fraudulent login pages designed to harvest credentials and multi-factor authentication codes.
The targets of this extensive campaign have included financial and legal firms, which often handle sensitive information valuable for extortion. Previous targets have also spanned sectors such as manufacturing, healthcare, insurance, technology, and hospitality.
It has not been confirmed whether UNC6671 was specifically responsible for the successful intrusion at Levi's. The denim company has also not publicly detailed the exact nature of the stolen information or whether any extortion attempts were made following the breach.
