Levi’s Cybersecurity Breach Puts Apparel Industry Risks in Focus

Levi Strauss & Co. (LS&Co.) recently fell victim to a cybersecurity breach, disclosing the incident to the U.S. Securities and Exchange Commission on August 7. Hackers, through social engineering, infiltrated the company's systems via three employees' company-issued computers, causing unauthorized access to corporate data. LS&Co. suspects that sensitive information was both accessed and exfiltrated during the attack.

In response, the company activated its emergency protocols, executed containment measures, and initiated an ongoing investigation, enlisting the assistance of third-party cybersecurity experts. While LS&Co. maintains that the breach won't materially impact its operations, the event underscores a broader issue: the vulnerabilities inherent in the complex web of relationships among fashion brands and their suppliers.

Major brands such as Adidas, The North Face, Nike, Victoria's Secret, Gucci, and Balenciaga have also experienced cybersecurity incidents in recent years. Joe Schloesser, senior vice president at ISN, a firm specializing in contractor and supplier information management, emphasized that brands must gain a clearer understanding of their business partners and potential risks.

He stressed that bad actors are increasingly targeting trusted relationships, including employees, contractors, suppliers, and other third parties. To mitigate risks, Schloesser advocated for strong verification processes, least-privilege access, and monitoring. These measures should extend to contractors and suppliers, where most organizations fall short.

Schloesser added that third-party risk management is a critical area where brands often lack maturity, particularly in complex supply chains where a brand may have limited visibility into a supplier's security culture. A cyberattack on a smaller supplier could potentially serve as a backdoor into a larger brand, he warned. ISN provides solutions to mitigate these vulnerabilities, with its Transparency-One platform enabling supply chain transparency and traceability.

By collecting and reviewing various information, brands can better understand their supply chain partners' security posture. Schloesser emphasized that transparency itself is not a vulnerability; rather, the risk lies in how information travels. Exchanging data through controlled platforms reduces exposure rather than increasing it.

He urged brands to integrate cybersecurity into their broader supply chain risk conversations, asserting that greater transparency is an advantage, not a liability.