\n<\/p>\n
VF Corporation, the U.S.-based owner of apparel brands including Vans, Supreme, and The North Face, has confirmed a cyberattack has impacted the company\u2019s ability to fulfill orders ahead of Christmas, one of the biggest retail events of the year.<\/p>\n
The Denver, Colorado-based corporation said in a filing with federal regulators<\/a> that the cyberattack, which the company first detected on December 13, saw hackers disrupt the company\u2019s operations \u201cby encrypting some IT systems, and stole data from the company, including personal data,\u201d implying a ransomware attack.<\/p>\n As a result, the company says it continues to experience operational disruptions, including its \u201cability to fulfill orders.\u201d<\/p>\n When TechCrunch attempted to place an order on the Vans website, a message read: \u201cApologies, due to logistical disruption, the estimated delivery dates shown in the checkout process are incorrect. You will be notified by email when your item ships and can then track it with the shipper.\u201d<\/p>\n VF Corp. said in its filing that the retail stores it operates globally are open, and that consumers can purchase available merchandise online. It\u2019s unclear when orders are expected to ship, and a company spokesperson did not say when.<\/p>\n When reached by email, VF Corp. spokesperson Colin Wheeler provided TechCrunch with a statement that echoed the company\u2019s filing with regulators. The company did not answer TechCrunch\u2019s questions about the incident, nor would it say whether the company had received a ransom demand from the hackers.<\/span><\/p>\n The company has not yet said how it was compromised, what kinds of data was accessed, and how many individuals \u2014 whether employees, customers, or both \u2014 are affected by the breach. It\u2019s also not known who was behind the attack, which has not yet been claimed by any tracked ransomware group.<\/p>\n In its regulatory filing, VF Corp. warned that the cyberattack would have a \u201cmaterial impact\u201d on its business until its systems are recovered. \u201cAs the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet known,\u201d the filing states.<\/p>\n VF Corp disclosed the incident on the same day that the U.S. Securities and Exchange Commission\u2019s new data breach disclosure rules came into force<\/a>. This regulation means that organizations must report cybersecurity incidents, including data breaches<\/a>, to the federal government\u2019s securities regulator\u00a0<\/span>within four business days.<\/p>\n<\/p><\/div>\n