Corporate Data Stolen in Levi Strauss Cyberattack

Summary

Levi Strauss & Co. has reported a cyberattack that resulted in the exfiltration of certain corporate data from three employee computers. The company stated that the incident was initiated through social engineering tactics. While an investigation is ongoing, Levi Strauss has confirmed no customer data was compromised and business operations remain unaffected, with no material impact expected.

Full text

Denim company Levi Strauss & Co on Friday disclosed a cyberattack that affected certain corporate data stored on employee computers. The incident, it said in a Form 8-K filing with the US Securities and Exchange Commission (SEC), was the result of social engineering and affected three employees’ company-issued computers. The company says its immediate response and containment actions have resulted in the attackers’ eviction from the compromised computers. “Based on preliminary findings from the company’s investigation, the company believes that certain corporate information was accessed and exfiltrated as a result of the incident,” Levi Strauss told the SEC. According to the company, the investigation into the attack is ongoing, but based on the preliminary findings no customer data appears to have been stolen. “The company has not experienced any interruption in business operations as a result of the incident,” Levi Strauss said.Advertisement. Scroll to continue reading. The company also said it did not believe that the incident “has had, or is reasonably likely to have, a material impact”. Levi Strauss did not say who was behind the attack or whether it received any extortion demands, and has not shared details on the type of social engineering the threat actor used. According to some unconfirmed reports, however, UNC6671, a hacking group behind multiple recent voice phishing (vishing) campaigns, might have been involved. SecurityWeek has emailed Levi Strauss for additional details on the data breach and will update this article if the company responds. Related: 3.8 Million Impacted by Unlimited Technology Systems Data Breach Related: Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack Related: Cyberattacks on Minnesota Water Systems Investigated as Officials Warn About Iranian Hackers Related: Google Adopts New Threat Actor Naming System Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire 3.8 Million Impacted by Unlimited Technology Systems Data BreachCritical Vulnerabilities Patched With Chrome 151 UpdateCritical Paperclip Flaw Allowed Admin Access, Code ExecutionBelarusian Ransom Cartel Mastermind Gets 16 Years in PrisonCisco Patches Critical SD-WAN, IOS XE, FMC VulnerabilitiesHackers Start Exploiting Recent JetBrains TeamCity Vulnerability311,000 Impacted by Brown Health Medical Group-MA Data BreachAI Agents Targeted Real People and Projects During Cybersecurity Tests Latest News CISA Urges Immediate Patching of Exploited Progress LoadMaster VulnerabilityCritical Flaws Discovered in Belgian eID Software Used by 2 Million PeopleCritical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise DataIn Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall StreetVishing Extortion Group UNC6671 Rebrands After Making MillionsTruck Brake Controller’s Safety Recall Doubled as Hidden Security FixBlack Hat USA 2026 – Summary of Vendor Announcements (Part 4)Microsoft, Apple Release Fresh Security Updates Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the Move1Kosmos has named Frank Cohen Chief Revenue Officer.ServiceNow has appointed Simon Mouyal as Chief Marketing Officer.James Wilkinson has been named Chief Information Security Officer for the City of Dallas.More People On The MoveExpert Insights Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) Flipboard Reddit Whatsapp Whatsapp Email

Entities