Levi Strauss discloses cyber breach after social engineering attack

Levi Strauss disclosed a cybersecurity incident Friday after an unauthorized third party gained access to its systems through a social engineering attack that targeted three employees. The company said some corporate data may have been stolen, while consumer data and business operations were not affected.

The breach adds another known brand to a retail sector already under pressure from attacks that target customer accounts, employee credentials and third-party links. Levi Strauss sits in that exposure zone because it runs stores, e-commerce and payment processing while holding customer data that can be valuable long after a single transaction.

The disclosure also lands against a larger pattern of attacks that move across industries looking for weak entry points. In retail, a social engineering campaign can be as damaging as malware because it uses people, not code, to slip past defenses and reach internal systems. Even when stores keep operating, a breach can still trigger forensic work, legal review, customer notices and system hardening.

Levi Strauss has already dealt with a separate account-security incident. In June 2024, the company said bad actors tried to log in to some accounts using email and password combinations obtained elsewhere, a pattern known as credential stuffing. The problem was detected on June 13, 2024, and the company issued a forced password reset after spotting suspicious activity on its website.

That earlier case reached the consumer notice system in California and the breach reporting process in Maine. State filings put the number of affected customers at about 72,000, with one filing citing 72,231 potentially impacted individuals. In its June 21, 2024 consumer notice, Levi Strauss told customers to use unique, complex passwords and to reset passwords on other sites where the same credentials had been reused.

Maine’s breach law requires certain businesses and organizations to report data security incidents to the attorney general, which is one reason retail intrusions quickly become both a security problem and a regulatory one. For a public company like Levi Strauss, the practical stakes now stretch well beyond one incident: customer trust, vendor oversight, insurance costs and the question of how much internal and consumer data the business should be holding in the first place.