Victoria's Secret cancels US website after “security incident”

Underwear company Victoria's Secret has removed its U.S. website and said it has stopped some in-store services following what it calls a “safety incident.”

The normal website has been replaced by a customer notification that says it “works around the clock to fully resume operations.”

It says its stores (and its derivatives pink shops) are still in business.

The company's UK website is not affected.

In a statement, the company detailed the actions it has taken.

“We immediately enacted a response agreement, third-party experts are engaged, and we took precautions to our website and some in-store services,” it said.

It provides no further details about the nature of the event, nor confirms the beginning of the event.

Located in Ohio, the United States, the company operates approximately 1,350 retail stores in 70 countries.

Its shares fell about 7% when it first released a media statement about the incident on Wednesday.

Some customers have already complained about social media to complain about its impact on them.

“How do I check my order status when your page is deleted for 2 days?!? No one answered the call either!”, wrote on X.

The Victoria Secret incident follows a major cyber attack on many major UK retailers.

M&S said it expects it to spend about £300 million on hacking impacts, with the disruption continuing until July.

The cooperative experienced empty shelves and damaged payments after being hacked.

Both companies were stolen from customer data.

The cybercriminals who said they were responsible told the BBC they targeted the companies with ransomware, which involved pieced together IT systems and told the company that they would only recover in exchange for payments.

Police told BBC News that the spiders of the criminal gang, some of which were considered teenagers, were the suspects.

Vonny Gamot from online protection company McAfee recommends that any affected customers should act immediately, such as changing their passwords and enabling two-factor authentication on accounts that support the account.

She also said people should not wait to find out if they are directly trapped in a cyber attack.

“Even if you have not received notification from the affected brand or retailer, assume your information may be affected by the customer,” she said.

“Companies usually take weeks to identify all those affected.”