Levi Strauss Reports Corporate Data Stolen in Cyberattack

Levi Strauss & Co. disclosed in a Form 8-K that social engineering allowed threat actors to access and exfiltrate corporate information from three company-issued employee laptops. The company’s preliminary investigation found no evidence that customer data was taken. Levi Strauss reported it removed the intruders from the affected devices and opened an internal investigation.

The incident was identified after the company determined three endpoints were compromised. Levi Strauss noted its immediate containment actions and said it has not experienced any interruption to business operations. The filing adds the company does not believe the incident has, or is reasonably likely to have, a material impact.

The filing did not specify which social engineering tactics were used, such as email phishing or voice phishing, and did not name any suspected threat actors or state whether extortion demands were received. The company also did not list the types of corporate information that may have been accessed or how long the intruders were present before detection.

Some unconfirmed reports have linked the activity to UNC6671, a group tied to recent voice-phishing campaigns; Levi Strauss has not confirmed any connection.

Levi Strauss is continuing its review, working with outside cybersecurity specialists where appropriate, and assessing the full scope of systems and data affected. The company said it will evaluate whether additional notifications are required if further evidence emerges.

Companies use Form 8-K filings to notify investors and the public about material events, including cybersecurity incidents. Levi Strauss’ disclosure follows a pattern of public companies reporting potential data access when internal reviews identify a possible breach, even when operations continue without disruption.