VF Outdoor, Parent to Timberland, North Face, Suffers Credential Stuffing Attack
VF Outdoor, the parent company to The North Face and Timberland, suffered a credential stuffing cyberattack last month and decided to release details of the attack even though the firm said the threat actors did not obtain any customer data from the site.
On March 13, the company ended up alerted to unusual activity involving its website, [thenorthface.com or timberland.com], that prompted it to investigate immediately.
“Following a careful investigation, we concluded that an attacker had launched a small-scale credential stuffing attack against our Website on March 13, 2025,” the company said in a letter to victims. “A ‘credential stuffing attack’ is a specific type of cybersecurity where the attacker uses account authentication credentials (e.g., email addresses/usernames and passwords) stolen from another source, such as a breach of another company or website, to gain unauthorized access to user accounts.