Outdoor apparel brand ‘The North Face’ was targeted in a large-scale credential stuffing attack that has resulted in the hacking of 194,905 accounts on the thenorthface.com website.
A credential stuffing attack is when threat actors use email addresses/usernames and password combinations obtained from data breaches to attempt to hack into user accounts on other websites.
The success of these attacks relies on the practice of password recycling, where a person uses the same credentials across multiple online platforms.
The credential stuffing attack on The North Face website began on July 26, 2022, but the website’s administrators detected the unusual activity on August 11, 2022, and were able to stop it on August 19, 2022.
After investigating the attack, North Face determined that the attackers managed to breach close to 200,000 accounts using valid credentials, potentially accessing the following customer information:
Full name
Purchase history
Billing address
Shipping address
Telephone number
Account creation date
Gender
XPLR Pass reward records
Payment details like credit card data are not stored on the website, so the attackers could not access sensitive financial information.
“We do not keep a copy of payment card details on thenorthface.com. We only retain a “token” linked to your payment card, and only our third-party payment card processor keeps payment card details,” explains the firm in the breach notification.
“The token cannot be used to initiate a purchase anywhere other than on thenorthface.com.”
In response to the security incident, the brand’s parent firm, VF Corporation (formerly Vanity Fair Mills), is sending notices of data breach to impacted customers.
Additionally, all user passwords have been reset, and all payment card tokens on accounts accessed by unauthorized intruders were wiped.
Hence, impacted customers with an account on the website will have to enter a new password and re-enter their payment card details to make a purchase.
Of course, affected users are expected to pick a unique, strong (long) password and avoid the comfort of recycling credentials.
Also, if the customers use the same passwords on other online platforms, those should be changed immediately to avoid additional compromises.
Notably, this is the second time The North Face reset passwords following a successful credential stuffing attack, with the previous one dating back to November 2020.
VF Corporation owns several successful brands besides The North Face, like Vans, Timberland, Eastpak, Kipling, Dickies, and Napapijri. However, those don’t appear to have been impacted by this or similar attacks.
