VF Corp. (NYSE: VFC), parent company of Costa Mesa-based Vans, filed an update regarding a cybersecurity incident on its IT systems from December.
“VF currently estimates that the threat actor stole personal data of approximately 35.5 million individual consumers,” the company said in a SEC filing on Thursday, clarifying VF had no records of social security numbers, bank account or payment card information.
VF added that there is no evidence to date of any customer passwords being acquired.
The retail operator said its VF-operated stores, websites and distribution centers “are operating with minimal issues” following disruptions to retail inventory and order fulfillment operations. VF is currently working through impacts from the incident and will be seeking reimbursement of costs, expenses and losses as the investigation continues.
Impacts “are not reasonably likely to be material to its financial condition and results of operations,” the filing said.
VF currently has a market cap of $6 billion. Vans, one of VF’s two largest business units, reported revenue of $1.4 billion for six months ended Sept. 2023.
Two other Orange County companies have recently been hit by cyber attacks.
Irvine-based mortgage lender LoanDepot Inc. (NYSE: LDI) said on Jan. 9 it had “identified a cybersecurity incident” that reportedly may have involved a ransomware attack.
Santa Ana-based First American Financial Corp. (NSYE: FAF) on Dec. 21 said it “experienced a cybersecurity incident,” which caused it take certain systems temporarily offline. The company didn’t elaborate.
