Cyber Incident Victim: Veja
Date:
Apr 2021
Location:
France
Summary
Veja, a French eco-friendly footwear brand, experienced a cybersecurity breach resulting in the theft of its customer database containing email addresses. The company confirmed no financial data was compromised as it does not store such information, and stated that any stolen passwords remained protected through encryption. Authorities including specialized judicial police were engaged to investigate the incident, with reports indicating the hacker had already been identified; the organization filed requisite notifications with data protection regulators following the attack.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 26, 2021, French footwear and accessories brand Veja suffered a cybersecurity breach resulting in unauthorized access to its customer database. Attackers exfiltrated records containing customer email addresses, though the full scope of compromised data remains unspecified in public disclosures. The company, known for its eco-friendly sneakers marked with a "V" and manufactured in Brazil, confirmed through co-founder Sébastien Kopp that no banking information was exposed during the incident, as Veja did not store such financial data. Kopp further stated that any stolen passwords remained protected through encryption mechanisms, though the specific encryption standards or hashing protocols employed were not detailed. The breach represented a significant operational disruption for the brand, necessitating immediate incident response coordination with legal and regulatory authorities.
Veja initiated formal response procedures by lodging a criminal complaint with French law enforcement and submitting a mandatory data breach notification to the Commission Nationale de l'Informatique et des Libertés (CNIL), France's data protection authority. Judicial police specializing in cybercrime investigations assumed control of the case, with early investigative progress indicated by authorities reportedly identifying a suspect—described in machine translations as the hacker having been "spotted" or "repéré." The precise meaning of this status remained ambiguous in English-language reporting, leaving uncertainty whether investigators had physically located the threat actor, identified a digital footprint, or developed a credible lead. No subsequent public updates clarified the investigation's outcome, the attacker's motivations, or whether data appeared in illicit forums. The incident underscored persistent risks to consumer data integrity even when companies implement protective measures like financial data avoidance and password encryption.