Vans, Supreme owner VF Corp says hackers stole 35 million customers’ personal data

VF Corp., the parent company of the popular apparel brands Vans, Supreme, and The North Face, said Thursday that hackers stole the personal data of 35.5 million customers in a December cyberattack.

The Denver, Colorado-based company reported the data breach to regulators in a filing on Thursday. The filing did not say specifically what kinds of personal data was taken, or if the company yet knows what was stolen. VF Corp. spokesperson Colin Wheeler did not respond to an email from TechCrunch requesting more information.

VF Corp said it does not retain consumer Social Security numbers, bank account information, or payment card information for its consumer businesses, nor does the company have evidence that the hackers stole customer passwords.

VF Corp. previously said the hackers disrupted its operations “by encrypting some IT systems,” implying a ransomware attack. The ransomware and extortion gang known as ALPHV (or BlackCat) later claimed credit for the breach.

VF said at the time of the incident that it was experiencing operational disruptions and its “ability to fulfill orders.” In its Thursday filing, VF said it is “still experiencing minor residual impacts from the cyber incident,” but that it has caught up on fulfilling orders that were delayed.

The company said it “has substantially restored the IT systems and data that were impacted by the cyber incident, but continues to work through minor operational impacts.”

Do you work at VF Corp. and know more about the cyberattack? You can contact Zack Whittaker by email. You also can share files and documents with TechCrunch via our SecureDrop.