Cybercriminals Strike VF Corporation, LoanDepot And Carnegie Mellon!

As technology grows and businesses adopt digital technologies, there is a risk that they need to be weary of – cybercrime. We’re sure you knew that already!

Cybercriminals are always on the lookout to exploit vulnerabilities in business networks, servers and other weak points. Yet the biggest loser is the customer, suffering the brunt of having their private data being leaked and sold to other malicious actors.

Recently, in a wave of cyber-attacks, renowned businesses and organizations were hit by cybercriminals. So, which businesses and organizations were hit and how were they affected?

Let’s explore!
 

What Happened To VF Corporation?

 

• In an SEC filing dated December 18, 2023, VF Corporation reported that the company was the victim of a cyber-attack. VF Corp is the owner of apparel and fashion brands like Vans, North Face, Timberland, Dickies and more. 

• The company said it observed “unauthorized occurrences” on a portion of IT systems first on December 13 and stated the date of the earliest event reported as December 15, 2023.

• After this, the company began an investigation with leading external cybersecurity experts, activated its incident response plan and shut down some systems. It even affected customer holiday order fulfillment. The unauthorized users were ejected on December 15.

• Through this, VF Corp found that hackers had encrypted some of its IT systems and stolen private data, however, at the time it was unclear if customer data was impacted.

• Now, in a follow-up filing dated January 18, 2024, the company stated the data breach impacted around 35.5 million customers, it’s still facing minor residual impacts from the cyber incident. However, the company did not confirm who was behind the attack.

• While the company did not make known what kind of data was stolen, it did clarify that the company doesn’t collect or retain any consumer social security numbers, bank account information or payment card information as part of its direct-to-consumer practices. Additionally, it did not find any evidence of passwords being stolen.

• The filing read, “Since the filing of the Original Report, VF has substantially restored the IT systems and data that were impacted by the cyber incident, but continues to work through minor operational impacts.”

 

What Happened With LoanDepot?

 

• Leading provider of home lending solutions, loanDepot (stylized as such), had initially disclosed it faced a cyber incident on January 8, 2024.

• In a new release, the company provided an update on the cyber incident saying it has been working with “outside forensics and security experts to investigate the incident and restore normal operations as quickly as possible.”

• While the company has made significant progress in restoring its services, it clarified that the unauthorized users gained access to sensitive personal data of around 16.6 million customers in its systems.

• To mitigate the effects of the breach, the company will notify the affected individuals and offer credit monitoring and identity protection services free of cost.

• Frank Martell, the CEO of loanDepot, said, “Unfortunately, we live in a world where these types of attacks are increasingly frequent and sophisticated, and our industry has not been spared. We sincerely regret any impact to our customers.”

• [Contd.] “The entire loanDepot team has worked tirelessly throughout this incident to support our customers, our partners and each other. I am pleased by our progress in quickly bringing our systems back online and restoring normal business operations.”

 

What Happened With Carnegie Mellon University?

 

• Carnegie Mellon University was hit by a cyber-attack last summer, starting August 25, 2023.

• Recently, the university disclosed that the attack impacted around 7,343 current and former students, employees, applicants, contractors and others. The university said that the individuals have been notified and credit monitoring services are being offered to them.

• “Our information security office secured the system within hours of detection and quickly engaged law enforcement,” read an excerpt from the university’s statement.

• Speaking about the data breach, the university said, “There is no evidence of fraud or inappropriate use of the information from those files. Out of an abundance of caution, CMU is offering credit monitoring and other services through Experian for anyone who may be impacted.”

• However, it’s quite likely that the unauthorized users gained access and copied names, social security numbers and birth dates.

In today’s digital environment, businesses must ensure that they not only make use of robust cyber security tools and measures but also keep up with the latest trends. This includes the additional capabilities that artificial intelligence (AI) brings to your cyber security outlook.

Do you think businesses that deal with large amounts of private and sensitive customer data should be held to stricter cyber security practices?

Let us know in the comments below!