A threat actor used social engineering techniques to gain access to the computers of three Levi Strauss employees, leading to the exfiltration of corporate data. The company disclosed the incident in a filing with the US SEC and stated that immediate containment actions were successful in evicting the attackers. Preliminary findings indicate that no customer data was compromised and that business operations were unaffected. The investigation remains active, and no confirmed attribution or extortion demands have been publicly shared. Unconfirmed reports suggest possible involvement of the UNC6671 group known for voice phishing campaigns, but this is not verified by Levi Strauss.

Certain corporate information stored on employee computers was accessed and exfiltrated. No customer data appears to have been stolen, and there has been no reported disruption to business operations. The company does not expect a material impact from the incident based on preliminary findings.

Levi Strauss has already taken immediate response and containment actions to remove the attackers from compromised systems. The investigation is ongoing. No additional mitigation steps have been publicly recommended by the company at this time.