Victoria’s Secret Battles Cyber Intruders as Website Goes Dark

Victoria’s Secret Battles Cyber Intruders as Website Goes Dark

At a glance:

• Victoria’s Secret took its U.S. website offline in late May 2025 after a security incident.
• The company brought in outside experts to investigate and restore its systems.
• It did not say at the time whether any customer data had been taken.
• The incident is one of several attacks on large retail brands in spring 2025.
• Shoppers were advised to watch their accounts and use strong, unique passwords.

Victoria’s Secret goes offline

Victoria’s Secret’s website went offline in May 2025. Shoppers saw a holding page. The company said a security incident was to blame, and the lingerie and apparel retailer joined a list of large brands hit by cyberattacks that spring.

Inside the Incident

The company later said it detected unauthorized access to its network on May 24, 2025. As a precaution it shut down its corporate systems and its e-commerce site, and some in-store services were also affected. The website came back on May 29, while work on corporate systems continued. The company did not say at the time whether customer data had been exposed.

How the company responded

Victoria’s Secret said it was working with third-party experts to investigate and restore operations, and that it had taken steps to secure its systems. It also delayed its first-quarter earnings release while the work went on. A precaution like that is costly. Shutting a major online store for several days during a busy shopping period shows how seriously the company took the intrusion.

Implications for Consumers

Customers do not need to panic, but they should watch their accounts. Check bank and card statements for unfamiliar charges. Turn on two-factor authentication, and change any password reused elsewhere, starting with email.

Why retailers keep getting hit

The Victoria’s Secret incident landed weeks after attacks on Marks & Spencer and Co-op in the UK. Retailers are attractive targets because they hold customer data and lose real money for every hour their stores are down. Underinvestment shows up quickly when an attack lands.

Who helps after an attack

Victoria’s Secret relied on outside incident response specialists, the same kind of firms most large retailers call after a breach. They contain the intrusion, work out what was touched and bring systems back safely.

What other retailers can learn

For other brands, the case shows the value of a tested response plan. Taking systems down quickly limited the damage. Being able to restore them in days rather than weeks depends on preparation done long before an attack.

What shoppers can do next

Customers can help protect themselves by learning to spot phishing messages that use a retailer’s name after a public incident. Businesses should layer their defenses, from multi-factor login to network segmentation, so that one stolen password does not open everything.

The bigger picture

Retail attacks are now routine news. Victoria’s Secret’s response, a fast shutdown followed by a staged recovery, kept the website outage to a few days, though the full cost of the incident was still being counted. For other retailers, the useful lesson is to plan for the day the website goes dark and to rehearse how to bring it back.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.