Loading story…
Levi Strauss & Co. disclosed that attackers used a social engineering attack against three employees, compromising company-issued computers and gaining unauthorized access to corporate files. The company said certain corporate information was accessed and exfiltrated, but it contained the intrusion quickly, reported no disruption to business operations, and said there is no evidence that consumer data was affected.
The incident was disclosed in an SEC filing, where Levi Strauss said it does not currently expect the breach to materially affect its business, operations, financial condition, or results. The investigation remains ongoing, no threat actor has publicly claimed responsibility, and the company said it will provide additional notifications to affected parties if required; some reporting has linked the activity to UNC6671, a cluster previously associated by Google Threat Intelligence Group with voice phishing campaigns.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Levi Strauss & Co. disclosed the cybersecurity incident on Friday in a filing with the U.S. Securities and Exchange Commission. The company said the investigation is ongoing and that it does not currently expect the incident to materially affect its business or financial condition.
Following discovery of the social-engineering intrusion, Levi Strauss said it notified law enforcement and engaged external cybersecurity experts while activating incident response and business continuity procedures. The company also said it would notify affected parties and regulators as appropriate.
Levi Strauss & Co. said an unauthorized third party used social engineering against three employees, gained access to three company-issued computers, and exfiltrated certain corporate information. The company said it quickly contained the intrusion, saw no business disruption, and found no evidence that consumer data was affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
13 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecysecurity.news
Open sourceteiss.co.uk
Open sourcetheregister.com
Open sourcedarkwebinformer.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcesec.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Five Below disclosed a cybersecurity incident in an SEC Form 8-K after a threat actor used **social engineering** to gain unauthorized access to a company-issued employee computer and exfiltrate files from the device. The retailer said anomalous activity was identified the following day, prompting activation of its incident response plan, engagement of third-party cybersecurity and forensic specialists, and immediate containment measures. The company said the intrusion was contained to the affected employee environment and that no other systems or platforms were impacted. Five Below also stated that no personally identifiable information was accessed or exfiltrated and that, based on its current assessment, the incident is not material to its business strategy, operations, financial condition, or results, while noting that conclusions could change if additional affected systems or harmful use of the stolen data is later identified.
Jul 23, 2026
**Figure Technology Solutions**, a blockchain-based lending/fintech firm, confirmed a **data breach** after an employee was **socially engineered**, enabling attackers to access and exfiltrate a **limited number of files**. The company said it is communicating with partners and impacted individuals, has begun sending notifications, and is offering **free credit monitoring** to recipients of breach notices; it has not publicly disclosed the total number of affected individuals or when the incident was detected. The cybercrime group **ShinyHunters** claimed responsibility and alleged Figure refused to pay a ransom, publishing about **2.5GB** of purportedly stolen data on its leak site. Journalists who reviewed samples reported the exposed data included **names, home addresses, dates of birth, and phone numbers**, increasing risk of identity fraud and follow-on phishing. ShinyHunters also told reporters the intrusion was part of a broader campaign affecting organizations including **Harvard University** and **UPenn**, and referenced victims that rely on **Okta** for single sign-on.
Jun 29, 2026
**Figure Technology Solutions** suffered a data breach in which attackers obtained and later publicly posted customer data. Reporting indicates the exposed dataset (dating back to **January 2026**) included roughly **967,200 accounts** / **900k+ unique email addresses**, along with **names, phone numbers, physical addresses, and dates of birth**. Figure confirmed the incident and attributed initial access to **social engineering**, stating an employee was tricked into providing access and that attackers stole a “limited number of files.” The **ShinyHunters** extortion group claimed responsibility and listed Figure on its leak site, alleging the leak included about **2.5GB** of data tied to loan applicants. The breach’s scale was corroborated by *Have I Been Pwned*’s publication of the incident details, while broader coverage noted Figure had not proactively disclosed the incident publicly at the time of reporting and that additional details (e.g., full scope and notification posture) were still emerging.
Jun 29, 2026