The North Face has warned that almost 200,000 accounts have been compromised as part of a suspected credential stuffing attack.

The outdoor clothing brand said that hackers had used stolen credentials to access customer accounts on its website thenorthface.com.

Starting on the 26th of July, 2022, the credential stuffing attack was only spotted by administrators from the North Face on the 11th of August due to increased activity. It took until the 19th of August to stop the attack.

According to the company, hackers breached a total of 194,905 accounts, potentially stealing customer details including their full names, billing and shipping addresses, as well as their telephone numbers.

However, since payment details, such as credit card numbers, are not stored on the website, the attackers would not have been able to access them.

Even if the hackers did not access payment information, they can use the information as part of spear phishing attacks or to inform and tailor other credential stuffing attacks.

“We do not keep a copy of payment card details on thenorthface.com. We only retain a ‘token’ linked to your payment card, and only our third-party payment card processor keeps payment card details,” a North Face statement reads.

“The token cannot be used to initiate a purchase anywhere other than on thenorthface.com.”

What is a Credential Stuffing Attack?

Credential stuffing attacks use information stolen in a data breach from one service to try and breach another service.

These attacks are common, as there are a large number of credential lists, some with millions or even billions of entries. They typically have a low success rate, relying on guesswork as to which accounts a user might have.

But if even a small number work, they have major consequences for their victims. And new technology makes them more efficient – automation means bots can use the stolen credentials to test popular services far faster than a person.

They also exploit patterns of behaviour in most people, such as reusing passwords across different accounts.

As such, one of the simplest ways to protect yourself against a credential stuffing attack is to use a different password for each account.

Recommended

• Leader Insights | What Scotland can learn from Silicon Valley
• Pandemic legacy to drive digital transformation in accountancy
• ICO takes action against two gov departments

In the aftermath of the credential stuffing attack, the North Face has reset all users’ passwords and wiped all payment tokens on accounts accessed by the hackers.

Furthermore, its parent company, VF Corporation, has sent notices of the data breach to all customers.

It has also recommended changing passwords on any other accounts that use the same one as the user’s North Face account.

“You should also be on alert for schemes known as ‘phishing’ attacks, where malicious actors may pretend to represent The North Face or other organisations. You should not provide your personal information in response to any electronic communications regarding a cybersecurity incident,” it added.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.