The North Face has warned its customers not to recycle log-in information on its customer accounts, following a cyberattack on its site last month that used a technique called “credential stuffing.”
In a notification filing with the Vermont Attorney General’s office, North Face’s parent VF Corp. submitted a draft of its letter to affected customers, noting that the breach occurred on April 23, 2025. The letter indicated that an attacker launched a “small-scale” credential stuffing attack” using email addresses/usernames and passwords stolen from another source, such as a breach of a different company or website, to gain unauthorized access to user accounts.
“Credential stuffing attacks can occur when individuals use the same authentication credentials on multiple websites,” VF said, add