Victoria's Secret cyberattack: Key systems restored

Victoria 's Secret announced that it has completed the restoration of all of its critical systems, which were affected by a serious cyberattack on May 24. The incident forced the company to temporarily disable its internal corporate networks as well as its online platform.

The lingerie company, which operates more than 1,380 physical stores in nearly 70 countries, said in a recent filing with the U.S. Securities and Exchange Commission (SEC) that its core operating systems are now fully restored and that it is working with independent cybersecurity experts to assess the full scope of the incident.

Despite the scale of the attack, Victoria's Secret estimates that there will be no significant impact on its full-year financial results. However, the company notes that it may face additional costs due to the attack and the recovery process.

See also: Erie Insurance: Cyberattack behind service outage

The cyberattack also delayed the release of Victoria's Secret's quarterly financial results , which were delayed because key systems needed to produce financial reports were down after the attack.

"The recovery process has impacted employee access to critical information and systems necessary to present our first quarter results, which ended May 3, 2025," Victoria's Secret said. As a result, the announcement and the corresponding conference call are being postponed until further notice.

So far, Victoria's Secret has not provided further details about the type of cyberattack, while no ransomware group has claimed responsibility for the incident.

See also: Sensata Technologies: Ransomware attack led to data breach

The incident comes at a time of increased cyberattacks on the fashion sector. In recent weeks, French luxury brands Cartier and Dior, while Adidas was also breached through a customer service provider.

Since April, the Scattered Spider, in collaboration with the ransomware gang DragonForce, has launched attacks against leading British retailers such as Marks & Spencer, Co-op and Harrods, heightening security concerns in the wider retail space.

Victoria's Secret and other major retailers are at a critical crossroads. The cyberattack is not just a technological incident; it's a test of their brand, their infrastructure, and their digital readiness to face the new threat landscape. If they don't radically upgrade their approach to cybersecurity, they risk losing not only sales but also their market position.

See also: United Natural Foods: Problems due to cyberattack

How can a modern company protect itself from cyberattacks?

• Implementing multi-layered security (defense-in-depth): Use of firewall, antivirus, IDS/IPS, and endpoint protection.
• Continuous software updates: Immediate installation of updates & patches for operating systems and applications.
• Staff training: Regular seminars on identifying phishing, social engineering and malicious actions.
• Strict access management: Least privilege policies and use of MFA (multi-factor authentication).
• Data encryption: Both in transit and in storage.
• Regular backups: Secure, isolated backups and restore tests.
• Establish security policies: Regulations and procedures for handling data and incidents.
• Security testing: Periodic penetration tests and vulnerability assessments.
• Information and Event Management (SIEM): For early detection and response to threats.
• Incident response plan: Preparation and exercise in attack scenarios for immediate response.

Source: www.bleepingcomputer.com