Levi Strauss said hackers used social-engineering tactics to compromise three employees, gain unauthorized access to company systems, and steal corporate data.
The company, according to Reuters, has not disclosed what information was taken or whether customer data was affected, and said the incident remains under investigation.
The breach comes amid a broader wave of attacks relying on employee impersonation, phishing, and credential theft. Reuters reported that attackers built customized phishing infrastructure targeting hundreds of organizations, raising the possibility that the Levi Strauss incident is connected to a wider campaign focused on gaining trusted access to corporate systems.
Current known and unknowns
Levi Strauss reported the incident in a Form 8-K filed with the U.S. Securities and Exchange Commission (SEC) on Aug. 7, giving a more precise account. The filing says an unauthorized third party used social-engineering techniques to gain access to the company-issued computers of three employees.
The company says it contained the unauthorized access, launched an investigation, and hired outside cybersecurity experts. Levi Strauss also said customer data was not affected and that the incident did not disrupt business operations.
Several important details remain unknown. The company has not disclosed what corporate information was stolen, how much data was exfiltrated, when the intrusion began, or exactly how the employees were deceived. Levi Strauss said its investigation remains ongoing and that it will notify affected parties and regulators where appropriate.
Levi Strauss appears to be one of many
At first glance, Levi Strauss’ cyber incident looks like any other cyberattack. But the timing argues otherwise.
Reuters reported that hackers had attempted to breach major Wall Street firms including Point72, Two Sigma and Citadel, with the attacks involving phone calls designed to lure employees into granting access or revealing sensitive information.
In a separated report, Reuters cited Google’s findings revealing that the campaign extended well beyond financial firms. Attackers had targeted other businesses, while technical analysis identified Levi Strauss, Uber and Zillow among organizations whose employees were targeted.
The attackers also created customized phishing traps for more than 200 organizations in about five weeks.
Google’s analysis linked several hacker aliases to the campaign and found that the attackers were using fake IT help desk identities, spoofed phone numbers, and fraudulent websites to obtain employee passwords and two-factor authentication codes.
The bigger problem is trusted access
Levi Strauss’ breach points to a security problem that is harder to solve. Once an employee is compromised, the attacker may be able to operate through legitimate accounts, making malicious activity harder to distinguish.
That raises the stakes for companies. Identity monitoring, strong authentication, device controls, and rapid detection of unusual account activity become just as important as perimeter defenses.
For Levi Strauss, the immediate question is what information the attackers obtained; for other companies, the warning is broader. A well-protected network can still be exposed when attackers convince an authorized employee to open the door.
Other News: A hacker tied to the 2024 Snowflake attacks pleaded guilty after a campaign that exposed data belonging to at least 100 million people.