The North Face warns customers of April credential stuffing attack

Outdoor apparel retailer The North Face is warning customers that their personal information was stolen in credential stuffing attacks targeting the company's website in April. The North Face is a major American outdoor apparel and equipment brand owned by VF Corporation that also controls Vans, Timberland, and Dickies. The North Face generates over $3 billion in annual revenue, making it one of the largest outdoor brands in the world, with its e-commerce accounting for approximately 42% of its total sales volumes. Credential stuffing attacks are a type of cyberattack where threat actors attempt to gain unauthorized access to user accounts by automating login attempts using username-password pairs previously exposed in data breaches. The technique is possible thanks to "credentials recycling," which is when people use the same username and password across multiple online services. However, if the accounts are protected by multi-factor authentication (MFA), these attacks fail even ... Read full article.