Loading story…
Five Below disclosed a cybersecurity incident in an SEC Form 8-K after a threat actor used social engineering to gain unauthorized access to a company-issued employee computer and exfiltrate files from the device. The retailer said anomalous activity was identified the following day, prompting activation of its incident response plan, engagement of third-party cybersecurity and forensic specialists, and immediate containment measures.
The company said the intrusion was contained to the affected employee environment and that no other systems or platforms were impacted. Five Below also stated that no personally identifiable information was accessed or exfiltrated and that, based on its current assessment, the incident is not material to its business strategy, operations, financial condition, or results, while noting that conclusions could change if additional affected systems or harmful use of the stolen data is later identified.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
Five Below identified anomalous activity on the affected employee computer, activated its incident response plan, engaged third-party cybersecurity experts, and implemented containment measures. The company said the intrusion was limited to the employee environment with no other systems affected and no personally identifiable information accessed or exfiltrated.
Five Below said a threat actor used social engineering to gain unauthorized access to a company-issued computer used by an employee and exfiltrated a number of files from the device.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Levi Strauss & Co. disclosed that attackers used a social engineering attack against three employees, compromising company-issued computers and gaining unauthorized access to corporate files. The company said certain corporate information was accessed and exfiltrated, but it contained the intrusion quickly, reported no disruption to business operations, and said there is no evidence that consumer data was affected. The incident was disclosed in an SEC filing, where Levi Strauss said it does not currently expect the breach to materially affect its business, operations, financial condition, or results. The investigation remains ongoing, no threat actor has publicly claimed responsibility, and the company said it will provide additional notifications to affected parties if required; some reporting has linked the activity to **UNC6671**, a cluster previously associated by Google Threat Intelligence Group with voice phishing campaigns.
Aug 14, 2026
F5 confirmed that a nation-state threat actor gained persistent access to its internal systems, resulting in the theft of *BIG-IP* source code, customer configuration data, and information on 44 vulnerabilities. The company stated that only a small number of customers were affected, all of whom have since applied emergency updates, and emphasized that the stolen data was not sensitive and that customer operations experienced minimal disruption. F5 has responded by expanding its bug bounty program and partnering with CrowdStrike to enhance endpoint detection and response (EDR) capabilities for *BIG-IP* systems, while external cybersecurity firms IOActive and NCC Group found no critical flaws in the stolen code. Despite F5's assurances that the incident is contained and the impact is limited, some independent researchers have raised concerns about the company's transparency and the true extent of operational control and reputational damage. The breach, discovered in August and disclosed in October, also triggered a federal emergency directive. F5 maintains that the incident has not significantly affected its business outlook, projecting up to 4% revenue growth in fiscal 2026, but scrutiny continues regarding the adequacy of its response and communication with stakeholders.
Jun 29, 2026
F5 disclosed that a prolonged intrusion by a nation-state threat actor resulted in unauthorized access to its internal systems, prompting emergency updates to BIG-IP software and hardware across its customer base. The company reported that configuration data belonging to a small percentage of customers was stolen during the attack, but emphasized that most customers were not significantly impacted. F5 worked rapidly with affected organizations to deploy critical patches, and a major North American technology provider was able to update over 800 devices within hours of the disclosure. The breach led to a rare emergency directive from federal cyber authorities, underscoring the seriousness of the incident. F5's leadership stated that the attack was first detected in August and publicly disclosed in October, with ongoing investigations to determine the full scope of data exposure. The company remains optimistic that the breach has been contained and that the majority of its largest customers have completed necessary mitigations with minimal disruption. The incident highlights the persistent risk posed by advanced threat actors targeting technology vendors and the importance of rapid response and transparent communication in managing supply chain security threats.
Jun 29, 2026