Levi Strauss has disclosed a breach that involved no software vulnerability at all. Attackers used social engineering to reach three employees’ work computers, then took corporate data out with them.
The company set out the incident in a regulatory filing with the SEC on 7 August. Intruders accessed and exfiltrated “certain corporate information”, the filing says, and it does not say what that information was.
The Register’s Carly Page reported the disclosure on Monday. Levi’s spotted the intrusion, started incident response, brought in outside cybersecurity experts and cut off the access.
What the filing says, and what it leaves out
The disclosure runs to a few short paragraphs under Item 8.01, the heading a company uses for events no other item covers. David Jedrzejek, the general counsel, signed it.
