The North Face resets passwords after credential-stuffing attack

guest · Nov 13, 2020

The North Face resets passwords after credential-stuffing attack
November 13, 2020
https://www.tripwire.com/state-of-s...s-passwords-after-credential-stuffing-attack/

An undisclosed number of customers of outdoor clothing retailer The North Face have had their passwords reset by the company, following a credential-stuffing attack.

The company has revealed that on October 9, 2020, it became aware that hackers had used usernames and passwords stolen from a third-party website to gain unauthorised access to customer accounts.

In a data breach notification sent to affected customers, The North Face explained that the hackers may have gained access to account information – including products previously purchased on its website, products that have been saved to “favorites”, billing and shipping addresses, names, birthdays, telephone numbers, email preferences, and loyalty point totals.
Click to expand...

Nonetheless, it does sound as if some unauthorised purchases may have been made as a result of the security breach. The North Face told Bleeping Computer that it will offer full refunds for any purchases made by the hackers.

In addition The North Face says it has introduced measures to spot suspicious activity which might signify a credential-stuffing attack in future.
Click to expand...

guest · Sep 7, 2022

200,000 North Face accounts hacked in credential stuffing attack
By Bill Toulas @billtoulas - September 7, 2022

Outdoor apparel brand 'The North Face' was targeted in a large-scale credential stuffing attack that has resulted in the hacking of 194,905 accounts on the thenorthface.com website.

A credential stuffing attack is when threat actors use email addresses/usernames and password combinations obtained from data breaches to attempt to hack into user accounts on other websites.
The success of these attacks relies on the practice of password recycling, where a person uses the same credentials across multiple online platforms.
Click to expand...

The credential stuffing attack on The North Face website began on July 26, 2022, but the website's administrators detected the unusual activity on August 11, 2022, and were able to stop it on August 19, 2022.

In response to the security incident, the brand's parent firm, VF Corporation (formerly Vanity Fair Mills), is sending notices of data breach to impacted customers.
Additionally, all user passwords have been reset, and all payment card tokens on accounts accessed by unauthorized intruders were wiped.
Hence, impacted customers with an account on the website will have to enter a new password and re-enter their payment card details to make a purchase.
Click to expand...

Notably, this is the second time The North Face reset passwords following a successful credential stuffing attack, with the previous one dating back to November 2020.
Click to expand...

Log in or Sign up

The North Face resets passwords after credential-stuffing attack

guest Guest

guest Guest

Log in or Sign up

The North Face resets passwords after credential-stuffing attack

guest Guest

guest Guest

Useful Searches