Incident disclosureDisclosed 2023-12-18V F CorpSEC filing

V F Corp discloses a cybersecurity incident (SEC 8-K, December 2023)

On December 13, 2023, VF Corporation (“VF” or the “Company”) detected unauthorized occurrences on a portion of its information technology (IT) systems.

What happened

  • Upon detecting the unauthorized occurrences, the Company immediately began taking steps to contain, assess and remediate the incident, including beginning an investigation with leading external cybersecurity experts, activating its incident response plan, and shutting down some systems.Form 8-K Item 1.05, V F Corp, filed 2023-12-18
  • The threat actor disrupted the Company’s business operations by encrypting some IT systems, and stole data from the Company, including personal data.Form 8-K Item 1.05, V F Corp, filed 2023-12-18
  • The Company is working to bring the impacted portions of its IT systems back online and implement workarounds for certain offline operations with the aim of reducing disruption to its ability to serve its retail and brand e-commerce consumers and wholesale customers.Form 8-K Item 1.05, V F Corp, filed 2023-12-18

The failure pattern

Insufficient segmentation lets a foothold spreadOne compromised account, vendor or network segment reaches management planes, backups and everything else.How to prevent it Audit trail missing actor, target or decisionAfter something goes wrong nobody can tell who or what took the action, on which object, or why.How to prevent it
Watch the pattern: Insufficient segmentation lets a foothold spread

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern