The North Face has warned its customers not to recycle log-in information on its customer accounts, following a cyberattack on its site last month that used a technique called “credential stuffing.”

In a notification filing with the Vermont Attorney General’s office, North Face’s parent VF Corp. submitted a draft of its letter to affected customers, noting that the breach occurred on April 23, 2025. The letter indicated that an attacker launched a “small-scale” credential stuffing attack” using email addresses/usernames and passwords stolen from another source, such as a breach of a different company or website, to gain unauthorized access to user accounts.

“Credential stuffing attacks can occur when individuals use the same authentication credentials on multiple websites,” VF said, add

See Full Page