The North Face reports credential stuffing attack
Learn More
Outdoor apparel retailer The North Face is reporting a credential stuffing attack that exposed customer personal information after unauthorized parties gained access to customer accounts on the company's website.
"On April 23, 2025, we discovered unusual activity involving our website, thenorthface.com, which we investigated immediately," reads the notice. "we concluded that an attacker had launched a small scale credential stuffing attack against our website on April 23, 2025."
In a credential stuffing attack threat actors attempt to gain access to user accounts by automating login attempts using username-password pairs previously exposed in data breaches from other sources. This technique exploits the common practice of password reuse across multiple online services. The compromised data includes:
- Full name
- Purchase history
- Shipping address
- Email address
- Date of birth
- Telephone number
The number of affected individuals has not been disclosed.
Update - VF Outdoor, which owns North Face and other brands reports that 2,861 people had their accounts accessed in this attack.
The North Face has now begun to send data breach notifications to impacted customers. The company notes that payment information was not exposed, as an external provider handles payments on the site, and The North Face doesn't retain any card data.
Two similar incidents were disclosed in November 2020 and September 2022, impacting over 200,000 customers. The most severe cybersecurity incident hitting The North Face was a December 2023 ransomware attack that was later confirmed to have impacted 35,000,000 customers.
