Victoria’s Secret & Co.
Victoria’s Secret & Co. network security incident
Summary
Victoria’s Secret & Co. shut down its corporate systems and U.S. e-commerce website after detecting unauthorized network access in May 2025, disrupting online sales, some store services and its earnings release. The website returned May 29 and all critical systems were operational by June 12; ransomware involvement, attribution and any data theft remain unresolved.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted location
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Website unavailable
A public-facing website was unavailable, disabled, or inaccessible.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Transaction processing disruption
Business, financial, customer, administrative, or operational transactions could not be completed normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Retail operations disrupted
Store, dealership, point-of-sale, inventory, fulfillment, or other retail operations were materially affected.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Victoria’s Secret & Co. experienced unauthorized network access that led it to shut down its corporate systems and U.S. e-commerce website in May 2025. The retailer’s June 3 disclosure says it detected the security incident May 24, engaged outside experts and took systems offline May 26 to contain and eradicate the access. Its website returned May 29, while corporate-system recovery continued. DysruptionHub assesses the cyber incident with high confidence because the company’s disclosures establish both unauthorized access and concrete operational effects.
The company publicly acknowledged a security incident in its May 28 customer update, saying that its website and some in-store services were unavailable while Victoria’s Secret and PINK stores remained open. The affected services crossed online retail, selected store functions and corporate work. The disclosures do not establish a shutdown of every store or a compromise of payment-card systems.
Operational significance
The website closure interrupted a customer-facing sales channel during the Memorial Day shopping period. Contemporaneous reporting documented the company’s outage message and precautionary restrictions on some store services.
The Associated Press also documented unavailable online customer care and restrictions on returning online orders in stores. By June 3, most affected store functions had returned, but employees still lacked access to systems and information needed to prepare the retailer’s first-quarter financial results. The company postponed its earnings release and webcast; the disruption occurred after that quarter ended and did not change its first-quarter results.
In its June 12 quarterly report, the retailer said all critical systems were restored and fully operational. Its 2025 annual report, filed in March 2026, subsequently confirmed that the incident was resolved and all systems had returned during the second quarter of 2025. These statements support resolved operational status. They establish recovery milestones rather than the exact day every affected function returned.
The company estimates that the incident reduced second-quarter 2025 net sales by about $20 million and operating income by about $14 million. Its September 2026 filing repeated those estimates and said the insurance-recovery process remained ongoing. These are separate measures of sales and operating-income effects. The retailer’s assessment that the incident did not cause a material disruption or material adverse financial effect is its corporate disclosure judgment; its filings separately document the website outage, corporate restrictions and postponed earnings release.
Confidence and uncertainty
The company’s acknowledgment establishes unauthorized network access, but it does not establish ransomware encryption, a particular malware family or a named perpetrator. Ransomware involvement and attribution remain unresolved. Contemporaneous discussion of other attacks on retailers does not establish that Victoria’s Secret shared their attackers or intrusion methods.
The reviewed disclosures do not establish theft or publication of customer, employee or payment information. Loss of access to corporate systems and information is documented; that operational effect is distinct from confirmed data acquisition. The public record also does not establish whether any ransom was demanded or paid.
Analytic gaps
The initial access method, extent of any information accessed or acquired, exact restoration date for each affected service and final insurance recoveries remain unresolved. The financial consequences continued to appear in later filings, but that reporting does not indicate continuing operational disruption. The headquarters in Reynoldsburg, Ohio, anchors the affected company geographically; the disclosures do not identify a headquarters-specific outage.
Organizations involved
Impacted location
Reynoldsburg, Ohio
The affected company’s headquarters is at Four Limited Parkway in Reynoldsburg. The disclosures do not establish a headquarters-specific outage or a citywide service interruption.
Sources
We reported that the U.S. website and some in-store services were unavailable during the retailer’s security incident. Later company disclosures establish the precise detection, shutdown and recovery dates.
Victoria’s Secret acknowledged a security incident, took its website and some store services offline as a precaution, and said its stores and PINK stores remained open.
The company’s website displayed a security-incident message. Victoria’s Secret said it enacted response protocols, engaged experts, and took the website and some store services offline while stores remained open.
The U.S. shopping site, online customer care and in-store returns of online purchases were unavailable. Stores remained open; the U.K. site appeared unaffected.
The company detected unauthorized network access May 24 and shut down corporate systems and e-commerce May 26. Its website returned May 29, but corporate access remained limited June 3, delaying its earnings release.
The company said all critical systems were restored and fully operational following the May 24 security incident. Its investigation continued and further expenses remained possible.
The company said the May 2025 incident was resolved and all systems were restored during second-quarter2025. It estimated a $20 million net-sales effect and $14 million operating-income effect, excluding potential future insurance recovery.
The company repeated estimated second-quarter2025 adverse effects of about $20 million on net sales and $14 million on operating income. Its cybersecurity-insurance claim process was still ongoing.
See something that needs correction?
Signed-in members can report an error, update, or missing source.