Victoria’s Secret website was down due to a ‘security incident’ impacting online and some in-store services. Get the latest on the lingerie giant’s efforts to restore operations and what customers need to know.
Lingerie giant Victoria’s Secret shut down its US website and some in-store services for three days due to an unspecified security incident. Customers attempting to access the Victoria’s Secret website were met with a message explaining the service disruption.
“Valued customer, we identified and are taking steps to address a security incident. We have taken down our website and some in-store services as a precaution. Our team is working around the clock to fully restore operations. We appreciate your patience during this process.”
Impact and Timeline
The company announced the measure on Thursday, May 29, 2025, stating it was a precaution and that their team is “working around the clock to fully restore operations.”
While the company has not provided a specific timeline for when services will be fully restored, a FAQ page suggests the issue may have begun on or after Monday, May 26.
Some customers on online forums like Reddit reported experiencing problems as early as Sunday night. The company also confirmed that it is working to fulfil orders placed before Monday. Although online operations are affected, physical Victoria’s Secret and PINK brand stores remain open.
However, some in-store services, like processing online returns, were unavailable, as were online customer care services. A note to employees from Victoria’s Secret CEO Hillary Super reveals that “recovery is going to take a while.” This suggests a complex cleanup process is underway.
The company has engaged third-party experts to help resolve the issue. Following this incident, shares of Victoria’s Secret & Co., reportedly, saw a decline of around 10%. The company’s lack of clear communication about the incident, including no updates on social media, has heightened uncertainty, likely led to this decline.
Another Retailor Hit by Cyber Attack?
This incident at Victoria’s Secret comes amidst a recent rise in cyberattacks targeting major retailers. As Hackread.com earlier reported, companies such as Marks and Spencer, Harrods, and Co-op have faced similar security challenges this year.
Two weeks ago, Dior reported a cybersecurity incident where unknown attackers accessed data on some of its Fashion and Accessories customers. Last week, the German shoe and clothing giant, Adidas, also reported an unauthorized external party obtaining consumer data, primarily contact information, through a third-party customer service provider.
The methods behind these attacks often involve social engineering, where cybercriminals trick individuals associated with a company into providing access to sensitive systems.
A notorious cybercrime group, Scattered Spider, has been identified as responsible for the VS incident as it has been targeting major retail brands in the UK and the US. These attacks can lead to significant disruptions, as seen with Marks & Spencer halting online orders for weeks due to a cyber incident. Experts advise consumers to be cautious after such incidents, as fraudsters may try to exploit the situation with fake promotions or by using compromised personal data.
At the time of writing, the Victoria’s Secret website for the US was restored and available for customers.
Experts’ Comments
Ben Hutchison, Associate Principal Consultant at Black Duck, a Burlington, Massachusetts-based provider of application security solutions, commented on the incident, stating, “Once attackers succeed in a sector, others often follow, making similar targets ‘victims of the moment.’ With rising attacks on retail, these businesses should treat this as a wake-up call to strengthen cybersecurity and digital resilience.”