RCMECredit materiality pre-analysisIncludes illustrative values
Analytical aid.Not a rating or rating recommendation. Public data only.
V.F. Corp
CIK
0000103379
SIC
2320
Event
8-K Item 1.05 · cyber incident
Identified
2023-12-13
Filed
2023-12-18
Overall
Moderate to Elevated
Audit trailOpen memo

Event lands · filed 2023-12-18

V.F. Corp: Form 8-K Item 1.05

Identified 2023-12-13. Disclosed 2023-12-18. Filed 2023-12-18.

Disclosure excerpt

Verified

On December 13, 2023, VF Corporation (“VF” or the “Company”) detected unauthorized occurrences on a portion of its information technology (IT) systems. Upon detecting the unauthorized occurrences, the Company immediately began taking steps to contain, assess and remediate the incident, including beginning an investigation with leading external cybersecurity experts, activating its incident response plan, and shutting down some systems. The threat actor disrupted the Company’s business operations by encrypting some IT systems, and stole data from the Company, including personal data. The Company is working to bring the impacted portions of its IT systems back online and implement workarounds for certain offline operations with the aim of reducing disruption to its ability to serve its retail and brand e-commerce consumers and wholesale customers. VF-operated retail stores globally are open, and consumers can purchase available merchandise, but VF is experiencing certain operational disruptions. Consumers are able to place orders on most of the brand e-commerce sites globally, however, the Company’s ability to fulfill orders is currently impacted.

Verbatim match to filing. Filing 0000950123-23-011228 · content sha256 351312a51a65

Quoted text is exempt from the vocabulary guard and tagged as quoted. Excerpt checked as an exact substring in code.

Structured incident

extraction_system.v2

Derived
FieldValueProvenance
incident_typeunknownDerived
attack_vectorunknownDerived
systems_affectedportion of information technology (IT) systems, brand e-commerce order fulfillmentDerived
data_types_compromisedPIIDerived
operational_statuspartial_disruptionDerived
regulatory_obligationsunknownDerived
third_party_impactNeeds analyst inputDerived
discovery_date2023-12-13Derived
disclosure_date2023-12-18Derived
containment_statusongoingDerived
discovery_to_disclosure_days5Derived
unknown_fieldsincident_type, attack_vector, regulatory_obligations, third_party_impactDerived
event_classcyber_incidentDerived

Analyst review

Append-only. Each review is a row on the audit trail.
IncidentFieldModel valueConfirmed valueReviewed (UTC)Note
Amgen2026-07-31operational_statusunknownfully_operational Analyst-confirmed2026-10-19 22:13:02Filing: "To date, the Company has not identified any impact to its products, manufacturing operations, or financial reporting systems, or to the Company's ability to meet patient needs." Amgen Form 8-K, Item 1.05. Reviewer: Shaunak.